Compliance
Compliance for Qefro buyers usually means answering questionnaires (security, privacy, AI), signing a DPA where required, and mapping product controls to frameworks. This page stays factual: shipped controls versus roadmap items.
Short definition (citation-ready)
Qefro provides multi-tenant SaaS controls (isolation, encryption of secrets, signed SDK invokes, SSRF-aware egress, logging, webhook verification) suitable as inputs to customer compliance programs. Formal certifications such as SOC 2 Type II are tracked on a roadmap — confirm current status with Sales.
Use Qefro controls in your program
| Your need | Map to Qefro |
|---|---|
| Customer data segregation | Tenant Isolation |
| Access control | Authentication & access, RBAC |
| Encryption | Encryption, Secrets |
| Network / SSRF | Network & egress |
| Data inventory / privacy | Data handling, Privacy |
| AI tool risk | AI Agent Security, Application security |
| Evidence of admin/tool activity | Audit Logs |
| Vulnerability reports | Vulnerability disclosure |
| Subprocessor / hosting questions | Contact Sales for current list |
| Legal | Privacy, Terms |
Implemented technical controls (summary)
- Organization (tenant) isolation on API, knowledge, storage, and connection paths
- Workspace-scoped knowledge, Business Tools, and Marketplace installs
- AES-256-GCM encryption for tool, SDK, and channel credentials at rest
- bcrypt password hashes for Admin Console / Portal users
- TLS for public HTTPS surfaces (
api.qefro.com,app.qefro.com, widget CDN) - HMAC-SHA256 signed
/qefroinvokes with timestamp skew protection - Ed25519-signed Marketplace packages; no arbitrary JavaScript in packages
- SSRF-aware egress for tools (HTTPS only, private/metadata IP block, DNS pinning)
- Optional end-user identity forwarding via widget
identify() - Organization-owned Customer Access Service (Qefro does not verify customer OTP)
- Organization audit logs, identity audit, and tool execution logs
- Authentication abuse rate limiting
- Razorpay and Meta (WhatsApp) webhook signature verification
- Session listing and revocation
Full narrative: Security Overview.
Roadmap / Enterprise discussions
| Topic | Notes |
|---|---|
| SOC 2 Type II | Roadmap — request timeline from Sales |
| SSO / SAML for Admin Console | Enterprise discussions |
| Private / VPC-style deploy | See Deployment; Enterprise packaging |
| Custom DPA / SCCs | Available through Sales for qualifying plans |
Vendor review workflow
Complete a customer security review
- Share this Security section — Start at Overview; attach isolation, encryption, egress, audit, compliance.
- Pilot with non-production data — Use a staging organization when possible.
- Define data classes — What may enter knowledge vs tools vs transcripts.
- Request DPA / subprocessors — Via Sales or [email protected].
- Re-check after enabling tools and apps — Actions and Marketplace installs change the threat model vs RAG-only.
Shared responsibility
| Qefro | Customer |
|---|---|
| Platform isolation and control plane security | Which documents you upload and which workspaces you bind to public channels |
| Encrypting stored tool / SDK / channel secrets | Scoping keys you issue to Qefro; rotating them |
| Signing platform → app invokes; verifying inbound billing/channel webhooks | Protecting your /qefro network path and ERP credentials |
| Logging admin, identity, and tool executions | Reviewing logs; exporting for your retention policy |
| Pattern-based chat PII masking (SSN / card-like digits) | Not treating Qefro as a DLP product; classifying regulated data |
| Honest status of certifications | Your internal risk acceptance |
FAQ
Where is data hosted?
Confirm the current hosting regions and subprocessors with Sales — infrastructure details can change and should not be frozen only in docs.
Can I use Qefro with regulated data?
Many teams start with non-regulated FAQs. For regulated workloads, complete a security review, DPA, and workspace/tool design with your counsel.
Does Qefro train foundation models on my data?
Product intent is to use your data to power your tenant’s assistants, not to train public foundation models on customer content. Confirm contractual language in your agreement / DPA. See Data handling.