Security at QueBids

• Infrastructure hosted on enterprise-grade data centres with SOC 2 Type II and ISO 27001 certifications
• Physical access to data centres controlled by biometric authentication, 24/7 security personnel, and CCTV
• Geographic redundancy with primary infrastructure in the US and failover capability in the EU
• Automated daily encrypted backups with 30-day retention and tested restoration procedures

• Security requirements defined at the design phase of every new feature
• Peer code review mandatory for all changes before merging to production
• Automated static application security testing (SAST) on every pull request
• Software composition analysis (SCA) scanning for vulnerable third-party libraries
• Staging environment mirrors production - all features tested before deployment
• Rollback capability maintained for all production deployments
• Annual third-party penetration testing by external security researchers

• Role-based access control (RBAC) for all platform features - users only access what their plan and role permits
• Multi-factor authentication (MFA) available for all accounts; mandatory for Enterprise accounts
• OAuth 2.0 / SSO integration supported for Enterprise customers (Google Workspace, Microsoft Entra ID)
• Automatic session expiry after 30 minutes of inactivity
• Concurrent session limits enforced to detect account sharing
• Account lockout after 5 failed login attempts with progressive delay

• MFA enforced on all internal systems and cloud provider accounts - no exceptions
• Key-based access to production servers - password authentication disabled
• Principle of least privilege: staff access scoped to minimum required for their role
• All administrative actions logged and audited monthly
• Production database access requires approval and is time-limited (4-hour sessions)
• Offboarding checklist ensures immediate revocation of all access when staff leave

• Private network isolates production infrastructure from public internet
• Database servers accessible only from application servers - no public internet access
• Firewall rules restrict traffic to only required ports and protocols
• Internal services communicate over private network with encrypted authentication

• Centralised logging of all authentication events, API requests, and administrative actions
• Real-time alerting on suspicious activity (failed logins, privilege escalation attempts, unusual traffic patterns)
• Automated anomaly detection flags deviations from normal user behaviour
• Security logs retained for 12 months for forensic analysis
• Uptime monitoring with 99.9% SLA and automatic failover

• Documented incident response plan with defined roles and escalation procedures
• Security incidents triaged within 1 hour of detection
• Critical incidents escalated to leadership and communicated to affected users within 24 hours
• Post-incident reviews conducted for all security events to identify root cause and prevent recurrence
• GDPR-compliant breach notification within 72 hours to supervisory authorities if required

• All vendors undergo security assessment before onboarding
• Data Processing Agreements (DPAs) executed with all processors handling personal data
• Standard Contractual Clauses (SCCs) in place for international data transfers
• Vendor security posture reviewed annually
• Sub-processor list maintained and available upon request

• Report via email to [email protected] with a detailed description and reproduction steps
• Include your contact information so we can follow up with questions
• Allow us reasonable time to investigate and remediate before public disclosure
• Do not exploit the vulnerability beyond what is necessary to demonstrate the issue
• Do not access, modify, or delete user data without explicit permission

• Acknowledgment of your report within 24 hours
• Regular updates on our investigation and remediation progress
• Good faith security research will not result in legal action

We welcome responsible security researchers and are grateful for reports that help us keep QueBids secure.

Valid, responsibly disclosed findings receive:

• Free product credits or extended access, scaled to the severity and number of valid findings
• Optional public credit for your finding
• A reference or thank-you letter on request

To discuss a report or its recognition, email us at [email protected].