Trust Center

We practice what
we sell.

A cybersecurity company with weak internal security is not a cybersecurity company. QAVRIC operates with the same discipline we recommend to clients — because we would not accept anything less from ourselves.

qavric.com/.well-known/security.txt

Our security.txt is published. If you discover a security issue with QAVRIC systems, please report it through our responsible disclosure process.

Report a Vulnerability
How We Operate

QAVRIC internal
security practices.

These are not aspirational policies. They are operational requirements.

Access Control

MFA everywhereMulti-factor authentication on every QAVRIC account — no exceptions.
Hardware security keysFIDO2 / WebAuthn keys used for critical administrative access.
Least privilegeEvery system and account has only the minimum permissions required.
Separate admin identitiesAdministrative credentials are distinct from day-to-day operations.

Data Protection

Encrypted devicesAll devices used for QAVRIC work are encrypted at rest.
Client data separationClient evidence and data is stored in isolated environments — never mixed.
Secure communicationsEnd-to-end encrypted channels for sensitive client communications.
Password managerAll credentials stored in a dedicated password manager. No plain-text storage.

Infrastructure

HTTPS everywhereAll QAVRIC systems use HTTPS. HTTP is not permitted.
Secure headersCSP, HSTS, X-Frame-Options, and other security headers enforced.
DNS securityDNSSEC where supported. Domain registrar lock enabled.
Dependency managementDependencies audited and updated regularly. Vulnerability scanning in CI/CD.

Operations

Automated backupsTested, automated backups for all critical QAVRIC data.
Monitoring & loggingAnomaly detection and logging across QAVRIC systems.
Incident responseDocumented incident response procedure exists before any incident occurs.
Security patchingDevices and systems patched promptly. No tolerance for known-vulnerable software.
Client Security

What we commit to
every client.

Authorization always comes first.

We never test a system without explicit, written authorization from the appropriate authority. Scope, rules of engagement, and emergency contacts are confirmed before any testing begins.

Your data stays yours.

Evidence collected during an engagement is used only for the purpose of that engagement. It is not retained beyond the agreed retention period and is never shared with third parties.

Findings are communicated confidentially.

Assessment reports and findings are delivered through secure channels. We do not discuss client findings externally without explicit written permission.

We stop if you say stop.

Every engagement has documented stop conditions. If testing is causing unexpected issues, we halt immediately and communicate.

Separate environments for every client.

Client evidence, credentials, and data are stored in isolated workspaces. Client A never has access to Client B's information — by architecture, not by policy alone.

Compliance

Certifications are earned,
not displayed prematurely.

QAVRIC will pursue formal compliance certifications — including ISO 27001 and SOC 2 — when the company reaches the operational maturity to sustain them meaningfully.

We will not put badges on this page before earning them. That is part of how we operate.

Transparency

Found a security issue
with QAVRIC?

If you discover a vulnerability in QAVRIC systems, we want to know. We commit to responding within 48 hours and remediating responsibly.

Report a Vulnerability →