At QueBids, security is engineered into every layer of our platform - from the infrastructure we run on, to the code we ship, to the processes our team follows daily. This page provides a transparent overview of our security posture. Enterprise customers may request our full security whitepaper and completed security questionnaires by contacting [email protected].
01
Infrastructure Security
QueBids runs on hardened cloud infrastructure with enterprise-grade security providers, providing multiple independent security layers from physical data centre through to the application tier.
Security Layers
Edge / CDN
Web Application FirewallDDoS ProtectionBot ManagementRate LimitingTLS Termination
Network
Private NetworkFirewall ProtectionIP FilteringPort RestrictionKey-Based Access
Compute
Container IsolationLeast PrivilegeResource LimitsAuto-Updates
Storage
AES-256 at RestEncrypted BackupsPrivate StorageSecure CDN
Database
Private Network OnlyAuth RequiredEncrypted VolumesDaily Backups
Physical & Data Centre Security
- Infrastructure hosted on enterprise-grade data centres with SOC 2 Type II and ISO 27001 certifications
- Physical access to data centres controlled by biometric authentication, 24/7 security personnel, and CCTV
- Geographic redundancy with primary infrastructure in the US and failover capability in the EU
- Automated daily encrypted backups with 30-day retention and tested restoration procedures
02
Application Security
Security built into every stage of our software development lifecycle.
Authentication
JWT-based authentication with short-lived access tokens and secure refresh token rotation. Strong password hashing with industry-standard algorithms.
Input Validation
All user inputs validated and sanitised server-side. Parameterised queries prevent SQL/NoSQL injection attacks.
HTTPS Enforcement
Industry-standard TLS encryption enforced on all endpoints. HSTS headers configured. HTTP traffic automatically redirected to HTTPS.
CSRF Protection
Anti-CSRF tokens on all state-changing requests. SameSite cookie attributes enforced across all session cookies.
Security Headers
CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers configured.
Dependency Scanning
Automated vulnerability scanning of all dependencies on every commit via integrated CI/CD pipeline checks.
Secure Development Lifecycle (SDLC)
- Security requirements defined at the design phase of every new feature
- Peer code review mandatory for all changes before merging to production
- Automated static application security testing (SAST) on every pull request
- Software composition analysis (SCA) scanning for vulnerable third-party libraries
- Staging environment mirrors production - all features tested before deployment
- Rollback capability maintained for all production deployments
- Annual third-party penetration testing by external security researchers
03
Data Protection & Encryption
Your data encrypted at every state - in transit, at rest, and in backups.
| Data State | Encryption Standard | Implementation |
|---|---|---|
| Data in Transit | TLS Encryption | All API, web, and inter-service communication encrypted. Certificate managed with automatic renewal. |
| Data at Rest | AES-256 | All database volumes and object storage encrypted at the block level by our infrastructure providers. |
| Passwords | Strong Hashing | Passwords hashed using industry-standard algorithms. Plaintext passwords are never stored or logged. |
| Backups | AES-256 | Daily encrypted backups with 30-day retention. Backup integrity verified monthly via test restoration. |
| API Keys / Secrets | Encrypted | Secrets managed via environment variables with restricted access. Never committed to version control. |
| Session Tokens | JWT | Short-lived JWTs (15 min access, 7 day refresh). Tokens invalidated on logout and password change. |
✅ Data Minimisation
We collect only the data necessary to provide our services. Payment card data is never stored on QueBids servers - all payment processing is handled directly by our secure payment processor, a PCI DSS Level 1 certified provider. 04
Access Control & Identity
Zero-trust principles applied to both user and internal access.
User Access
- Role-based access control (RBAC) for all platform features - users only access what their plan and role permits
- Multi-factor authentication (MFA) available for all accounts; mandatory for Enterprise accounts
- OAuth 2.0 / SSO integration supported for Enterprise customers (Google Workspace, Microsoft Entra ID)
- Automatic session expiry after 30 minutes of inactivity
- Concurrent session limits enforced to detect account sharing
- Account lockout after 5 failed login attempts with progressive delay
Internal (Staff) Access
- MFA enforced on all internal systems and cloud provider accounts - no exceptions
- Key-based access to production servers - password authentication disabled
- Principle of least privilege: staff access scoped to minimum required for their role
- All administrative actions logged and audited monthly
- Production database access requires approval and is time-limited (4-hour sessions)
- Offboarding checklist ensures immediate revocation of all access when staff leave
05
Network Security
Multi-layered network defences protect against attacks at every level.
DDoS Protection
Enterprise-grade global network absorbs and mitigates DDoS attacks before they reach our infrastructure.
Web Application Firewall
WAF blocks common attack patterns (OWASP Top 10) and malicious traffic at the edge.
Bot Management
Automated bot detection and mitigation prevents scraping, credential stuffing, and abuse.
Rate Limiting
API rate limits enforced per user and IP address to prevent abuse and ensure fair usage.
Network Segmentation
- Private network isolates production infrastructure from public internet
- Database servers accessible only from application servers - no public internet access
- Firewall rules restrict traffic to only required ports and protocols
- Internal services communicate over private network with encrypted authentication
06
Monitoring & Incident Response
24/7 monitoring and a defined incident response process ensure rapid detection and remediation.
Security Monitoring
- Centralised logging of all authentication events, API requests, and administrative actions
- Real-time alerting on suspicious activity (failed logins, privilege escalation attempts, unusual traffic patterns)
- Automated anomaly detection flags deviations from normal user behaviour
- Security logs retained for 12 months for forensic analysis
- Uptime monitoring with 99.9% SLA and automatic failover
Incident Response
- Documented incident response plan with defined roles and escalation procedures
- Security incidents triaged within 1 hour of detection
- Critical incidents escalated to leadership and communicated to affected users within 24 hours
- Post-incident reviews conducted for all security events to identify root cause and prevent recurrence
- GDPR-compliant breach notification within 72 hours to supervisory authorities if required
07
Compliance & Certifications
We are committed to meeting industry standards and regulatory requirements.
| Standard / Regulation | Status | Details |
|---|---|---|
| GDPR | Compliant | Full compliance with EU General Data Protection Regulation. DPO appointed. DPA available. |
| UK GDPR | Compliant | Aligned with UK data protection requirements post-Brexit. |
| CCPA | Compliant | California Consumer Privacy Act compliance for US users. |
📋 Enterprise Security Documentation
We are happy to complete standard security questionnaires (CAIQ, SIG, VSA) for enterprise procurement processes. Contact [email protected] to request our security documentation package. 08
Third-Party Security
We carefully vet all third-party service providers and ensure they meet our security standards.
| Provider Type | Service | Certifications |
|---|---|---|
| Cloud Infrastructure | Hosting & Compute | SOC 2 Type II, ISO 27001, PCI DSS |
| CDN & Security | CDN, WAF, DDoS Protection | SOC 2 Type II, ISO 27001, PCI DSS |
| Payment Processing | Payment Gateway | PCI DSS Level 1, SOC 2 Type II |
| Database Hosting | Managed Database | SOC 2 Type II, ISO 27001, GDPR |
| Email Delivery | Transactional Email | SOC 1/2/3, ISO 27001, PCI DSS |
Vendor Security Requirements
- All vendors undergo security assessment before onboarding
- Data Processing Agreements (DPAs) executed with all processors handling personal data
- Standard Contractual Clauses (SCCs) in place for international data transfers
- Vendor security posture reviewed annually
- Sub-processor list maintained and available upon request
09
Responsible Disclosure Program
We welcome security researchers to help us keep QueBids secure. If you discover a vulnerability, please report it responsibly.
How to Report
- Report via email to [email protected] with a detailed description and reproduction steps
- Include your contact information so we can follow up with questions
- Allow us reasonable time to investigate and remediate before public disclosure
- Do not exploit the vulnerability beyond what is necessary to demonstrate the issue
- Do not access, modify, or delete user data without explicit permission
What to Expect
- Acknowledgment of your report within 24 hours
- Regular updates on our investigation and remediation progress
- Credit in our security acknowledgments page (if desired)
- Good faith security research will not result in legal action
Bug Bounty Program
We welcome responsible security researchers. Contact us at [email protected] to discuss potential rewards for valid security findings.
10
Contact Our Security Team
For security inquiries, vulnerability reports, or enterprise security documentation requests, please contact our support team:
Get in Touch
Our support team is here to help. We respond to all security inquiries within 24 hours.