Tenant isolation
Each customer’s data is kept isolated from other customers’. The customer is identified by the sign-in, never by anything that can be supplied in a request, and access to data is restricted at the storage level per tenant.
Encryption
Data is encrypted in transit with TLS and at rest in storage, with keys managed by the Azure platform. The service’s own secrets are kept in Azure Key Vault.
Where data is stored and processed
Qimbas™ stores customer data within the EU. By default, the AI model that Qimbas™ uses in its analysis is run by a provider that may process and keep the data outside the EU/EEA. Customers who require the analysis to stay within the EU can choose that, and the AI model then runs within the EU too. Two more providers can access data from outside the EU/EEA: Cloudflare, which carries and decrypts traffic to the service in its network, and Microsoft, which hosts the service and in limited cases accesses it from outside the EU/EEA for support and security operations. The Subprocessors page lists each provider, where the processing takes place and which transfer mechanism applies. Beyond this, we do not transfer customer data outside the EU/EEA without the customer’s documented instruction.
Least privilege
The customer connects its sources through its own app registration in its own environment and chooses which sources to connect. The service requests only the read permissions required for the chosen sources, and the customer can see and revoke them in its own environment at any time.
Traceability
Access to systems that process customer data is logged. Analyses in Qimbas™ state which sources and time windows they are based on, so the result can be verified.
Reporting a vulnerability
Found a vulnerability in Qimbas™ or on this website? Email security@creedcon.se. Describe what you found and how it can be reproduced. We acknowledge receipt within two working days and keep you informed of the remediation. We ask you not to exploit the vulnerability beyond what is needed to demonstrate it and not to access other customers’ data. The details are also available in machine-readable form at /.well-known/security.txt.