Security and trust
How Qualflare splits security responsibilities, who owns each CSA CCM v4.1 control, how incidents are handled, and how to report a vulnerability.
Reviewed by Qualflare Team on
Last updated
Qualflare runs a self-conducted assessment against the Cloud Security Alliance Cloud Controls Matrix v4.1 (CCM), a framework of 207 controls in 17 domains. This section explains how security responsibilities are split, who owns each control, how security incidents are classified and how to report a vulnerability.
Shared Security Responsibility Model
How security and compliance responsibilities are split between Qualflare and your organization, area by area.
Control Ownership Map
Who owns each of the 207 CSA CCM v4.1 controls in the self-assessment: Qualflare, shared, or the customer.
Incident Response & Severity Levels
How Qualflare classifies security incidents into severity levels and notifies affected customers.
Report a vulnerability
Email security@qualflare.com with a description of the issue, the steps to reproduce it and its potential impact. Don't report vulnerabilities through in-app chat or support@qualflare.com, and don't open a public GitHub issue or post about the issue publicly. The Qualflare security policy describes the full process.
Related
- Account Security: two-factor authentication, passkeys and sessions for your own account.
- Getting Help: in-app chat, support@qualflare.com and service status.