Trust / Security
The security page names what is implemented, what is in beta, and which certifications QOrium does not claim yet.
Evidence posture
Evidence policy
Shipped rows need evidence. Beta rows need owner and date. Roadmap rows do not masquerade as live product.
Evidence ledger
Every row has a state, evidence source, owner, and verification date so buyers can see the real posture.
| Control | Status | Evidence | Owner | Verified |
|---|---|---|---|---|
| Transport and browser hardening | Shipped | Next.js security headers and health routes are present in the marketing app. | ARJUN | 2026-06-01 |
| Credential rotation discipline | Shipped | infra/B6-Secret-Rotation-Calendar.md defines rotation cadence and ownership. | CTO Office | 2026-06-01 |
| SSO SAML/OIDC | Beta | infra/SSO-SAML-Enterprise-Spec-v0.md exists; public badge remains off. | BHIMA | 2026-06-01 |
| Customer audit log | Beta | infra/Audit-Log-API-Spec-v0.md exists; customer-facing route remains gated. | BHIMA | 2026-06-01 |
| SOC 2 Type II | Not claimed | No certificate URL is present; QOrium does not render a SOC 2 badge. | CEO + Gatekeeper | 2026-06-01 |
| ISO 27001 | Not claimed | Auditor selection is separate from this product surface; no certification claim is rendered. | CEO + Gatekeeper | 2026-06-01 |
QOrium separates the public marketing surface from authenticated assessment, admin, and content services.
Sub-processors are named by purpose and region, with buyer review before production contracts require more specificity.
The page deliberately avoids proof that QOrium has not earned.
Sources