Security
Security as anoperating practice.
The controls below describe how QIOI is designed and operated. This page states what we do — and, just as clearly, what we do not claim.
An honest scope statement
QIOI is designed with security and privacy controls throughout the platform. QIOI does not claim SOC 2, ISO 27001, HIPAA, or GDPR certification. If your compliance programme requires certified infrastructure, talk to us before deploying — we will tell you plainly what fits and what does not.
One boundary is absolute: infrastructure-provider root credentials are never exposed to application instances. Instances receive only the access their workload requires.
Practices
Controls applied across the platform.
These are operating practices, not marketing badges. Each one is a defined behaviour of the platform or the team running it.
Encrypted secrets
API keys and credentials are stored encrypted at rest. Decryption happens only where the secret is used.
No plaintext keys in logs
Application and platform logs are scrubbed of credentials. API keys never appear in log output in plaintext.
Short-lived credentials
Where a provider supports them, temporary and short-lived credentials are preferred over long-lived keys.
Audit logging
Consequential actions — deployments, restores, deletions, access changes — are recorded with actor and timestamp.
Rate limiting
Authentication and management endpoints are rate-limited against brute-force and abuse.
CSRF protection
State-changing dashboard actions are protected against cross-site request forgery.
Secure cookies
Session cookies are set with HttpOnly, Secure, and SameSite attributes.
Input validation
All user-supplied input is validated server-side before it reaches provisioning or billing systems.
Backup encryption
Backups are encrypted before they leave the instance and stored off-instance.
Least-privilege provider credentials
Infrastructure-provider API credentials are scoped to the minimum permissions QIOI needs to operate.
Separate production and staging
Platform changes are tested in a staging environment before they touch production instances.
Secure deletion workflow
Deletion is a staged process with confirmation, a retention window for backups, and verifiable removal.
Role-based access
Team members receive roles with defined permissions instead of shared logins.
Organization separation
Customer organizations are isolated — instances, billing, and team access do not cross boundaries.
Email verification
Accounts require a verified email address before instances can be deployed.
MFA support
Multi-factor authentication is supported and recommended for all accounts.
Responsible disclosure
Found something? Tell us.
If you believe you have found a security issue in QIOI, report it privately. Do not test against instances or infrastructure you do not own — see the acceptable use policy.
security@qioi.io
Include steps to reproduce, the affected component, and your contact details. We acknowledge reports within one business day.