Security and data protection

Quantum Delivery Hub stores your data in Google Cloud's London region. That covers the platform database, uploaded and generated documents, sign-in, and all AI processing. The application itself runs in Vercel's London region. Data is encrypted in storage and in transit as standard.

Two limited exceptions are disclosed in our sub-processor list. Our hosting provider's build and logging systems, and our transactional email service, may operate outside the UK. Neither holds the records in your platform database.

• Two-factor authentication using an authenticator app. Your organisation administrator can make it compulsory for everyone, and the change applies straight away, even to people already signed in.
• Strong passwords: at least 12 characters.
• 62 named permissions, so each person sees and does only what their role needs. Permissions can be narrowed further for individual projects.
• Leavers lose access immediately. Their account is deactivated, and the record of what they approved is kept intact.

Every record belongs to one organisation, and the database's own security rules refuse any request for another organisation's data. That separation is enforced on the server, not just hidden in the screens, and it's checked by automated tests before every release. Files are never served directly to the browser. Every download goes through a check of the requester's permissions first.

When a governance document such as a PID is approved, it becomes a locked PDF with an audit record of who approved it and when. Revising it creates a new version, and the approved original is never altered.

• AI processing runs on Google Vertex AI in the UK, and is always called from our servers, never from your browser.
• Your content is never used to train AI models, by us or by Google.
• AI can suggest and draft, but it can't approve, send, issue or calculate anything. Every suggestion needs a person to confirm it.
• Budgets, schedules and utilisation are calculated by the platform itself, never by AI.
• Your administrator can switch each AI feature on or off individually.

• The platform database is backed up automatically every day, and each backup is kept for 14 weeks.
• It can also be restored to any minute in the previous 7 days.
• Deleted files can be recovered for 7 days.

• Built for UK GDPR and the Data Protection Act 2018.
• A Data Processing Agreement is signed with every customer.
• Our sub-processor list is published, and we give 30 days' notice of any change.
• You can read our Platform Privacy Policy, Data Protection and GDPR Policy, AI Disclosure and Sub-processor List at quantumdeliveryhub.com/legal.