# Security and trust

Source: https://docs.qualflare.com/docs/security · Last updated: 2026-10-25

How Qualflare splits security responsibilities, who owns each CSA CCM v4.1 control, how incidents are handled, and how to report a vulnerability.

Qualflare runs a self-conducted assessment against the [Cloud Security Alliance Cloud Controls Matrix v4.1](https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4-1) (CCM), a framework of 207 controls in 17 domains. This section explains how security responsibilities are split, who owns each control, how security incidents are classified and how to report a vulnerability.

- [Shared Security Responsibility Model](https://docs.qualflare.com/docs/security/shared-responsibility): How security and compliance responsibilities are split between Qualflare and your organization, area by area.
- [Control Ownership Map](https://docs.qualflare.com/docs/security/control-ownership): Who owns each of the 207 CSA CCM v4.1 controls in the self-assessment: Qualflare, shared, or the customer.
- [Incident Response & Severity Levels](https://docs.qualflare.com/docs/security/incident-response-sla): How Qualflare classifies security incidents into severity levels and notifies affected customers.

## Report a vulnerability

Email [security@qualflare.com](mailto:security@qualflare.com) with a description of the issue, the steps to reproduce it and its potential impact. Don't report vulnerabilities through in-app chat or [support@qualflare.com](mailto:support@qualflare.com), and don't open a public GitHub issue or post about the issue publicly. The [Qualflare security policy](https://qualflare.com/security-policy/) describes the full process.

## Related

* [Account Security](https://docs.qualflare.com/docs/how-to/account-security): two-factor authentication, passkeys and sessions for your own account.
* [Getting Help](https://docs.qualflare.com/docs/faq/getting-help): in-app chat, [support@qualflare.com](mailto:support@qualflare.com) and service status.