Shared Security Responsibility Model

Shared Security Responsibility Model

Qualflare runs a self-conducted assessment against the Cloud Security Alliance Cloud Controls Matrix v4.1 (CCM), a 207-control framework covering 17 security and compliance domains. This page summarizes, area by area, what Qualflare owns versus what depends on how you configure and use your workspace — the Shared Security Responsibility Model (SSRM) that assessment produces.

This is a summary, organized by domain. For ownership at the level of each individual control, see the Control Ownership Map. If you're doing formal vendor security due diligence and need the full control-by-control breakdown with our actual assessment findings (our CAIQ self-assessment), contact us and we'll share it under a standard mutual NDA.

How to read this

Most controls in the CCM are shared — Qualflare builds and operates the mechanism, and you're responsible for using it (choosing strong settings, managing who's in your workspace, deciding what to send us). A smaller set are fully ours — infrastructure and platform security you have no lever over. We call out the customer-facing responsibility explicitly wherever one exists; where we don't mention one, there isn't one — we're not implying you owe something we haven't described.

Identity & Access Management

Qualflare provides in-house password authentication (Argon2id hashing, breach-password blocklist, progressive lockout), TOTP and WebAuthn/passkey multi-factor authentication, Google/GitHub social sign-in, and SAML SSO with SCIM provisioning. New workspaces default to requiring MFA for every member. Every API request is checked against two independent authorization layers (row-level database isolation plus role-based access control), and access changes take effect immediately — removing a member or downgrading their role invalidates their existing sessions and tokens on the next request.

You're responsible for: who you invite to your workspace and at what role, keeping your own account's second factor enrolled, and promptly removing members who should no longer have access. If you use SSO, your identity provider's own configuration (domain verification, group-to-role mapping) is yours to maintain.

Cryptography, Encryption & Key Management

Sensitive data — credentials, OAuth tokens, TOTP secrets — is encrypted at rest with AES-256-GCM via Google Cloud KMS envelope encryption; database storage is encrypted at the disk level. All connections use TLS 1.3. Every key is platform-managed; there is currently no customer-managed-key (BYOK) option.

You're responsible for: nothing directly — encryption is entirely Qualflare-operated. If your organization requires customer-managed encryption keys as a contractual condition, talk to us before onboarding; it isn't available today.

Data Security & Privacy

Data is classified by sensitivity and handled accordingly, with row-level tenant isolation enforced by the database itself (not just application logic) — one workspace's data is structurally unreachable from another's queries. Account deletion irreversibly purges credentials and authentication material. TLS is enforced end-to-end, including to our AI model provider.

You're responsible for: what you choose to store as test data, case content, and attachments, and — if applicable — whether your workspace opts in or out of contributing to model-improvement training data (a workspace-level setting, opt-in by default).

Business Continuity & Resilience

Our database runs automated backups (continuous, near-real-time recovery point) with a weekly restore drill that actually rebuilds and validates a backup end-to-end, not just checks that one exists. We maintain a documented, criticality-tiered recovery plan across all deployed services with a defined restoration order. Compute infrastructure runs in a single availability zone today, with automatic container self-healing but no automatic cross-zone failover.

You're responsible for: nothing directly for infrastructure recovery. If your use case requires a contractual uptime SLA tighter than what we publish, talk to us — cross-zone redundancy is a designed, ready-to-activate upgrade we haven't turned on yet because no customer commitment has required it.

Application & Infrastructure Security

Our application undergoes independent-style automated security testing (static analysis, dependency vulnerability scanning, container image scanning) as hard gates on every code change, plus an annual penetration test covering authentication, authorization, and tenant isolation. Network access to our infrastructure is restricted by firewall to only what needs to be reachable, with SSH access requiring identity-aware proxying rather than direct exposure.

You're responsible for: keeping any API tokens or CLI credentials you generate confidential, and following secure practices in your own CI/CD pipelines that integrate with us.

Logging, Monitoring & Incident Response

Every security-relevant event (logins, permission changes, data access) is recorded in a tamper-evident, cryptographically hash-chained audit log, verified automatically every day. We maintain a documented incident response plan with defined roles, severity levels, and communication timelines — including a commitment to notify affected customers and, where legally required, regulators within 72 hours of confirming a breach. See Incident Response & Severity Levels for the full severity classification and response-time commitments.

You're responsible for: nothing directly. If we identify an incident affecting your workspace, we'll reach you via the contact associated with your account.

Supply Chain & Sub-processors

We maintain a current, published list of sub-processors — third parties who may process your data on our behalf — in our Data Processing Agreement and Privacy Policy, including their purpose, location, and data-transfer safeguards. Any change to this list is disclosed there before it takes effect.

You're responsible for: reviewing the sub-processor list if your own compliance obligations require it, and raising any objection through the process described in our DPA.

Governance & Compliance

We run this CCM self-assessment as an ongoing practice, cross-referenced against the NIST Cybersecurity Framework and CIS Controls, with tracked, dated findings and remediation. As a small, currently single-operator team, some governance controls that assume a larger organization (independent internal audit, formal segregation of duties across multiple people) are honestly not yet applicable — we say so directly in our full assessment rather than asserting practices we don't have.

You're responsible for: nothing directly here — this section describes our own internal governance posture.

Human Resources & Endpoint Security

Where these controls depend on having employees or a device fleet — background screening, security awareness training programs, mobile device management — they're honestly not yet built out; Qualflare is a small team today. Controls that don't depend on team size (endpoint device security for the individuals who do have production access, incident response roles and responsibilities) are documented and in place.

You're responsible for: nothing directly — this describes Qualflare's own internal operations.

Keeping this current

We review this page at least annually, and immediately after any change material enough to shift what's described above — not on a fixed calendar alone. When a review changes the ownership split for any area, we post it to our changelog under the Security category so you don't have to re-read this whole page to notice.

We also want to hear from you directly: if anything here doesn't match what you're seeing, or you think a responsibility should be split differently for your use case, email support@qualflare.com — this is a standing invitation, not just for formal due-diligence requests.

Questions

This page is a summary, current as of the date below, and doesn't replace the full self-assessment. For the complete control-by-control breakdown, a security questionnaire response, or anything else related to your organization's due diligence, reach us at support@qualflare.com.

Last updated: 2026-08-22