What QorTrace stores, how long, who sees it, and our sub-processor list.
What we store
| Data | Where | How long |
|---|---|---|
| Account email | MongoDB Atlas (encrypted at rest) | Until you delete the account |
| Password | Argon2id hash, salted | Until you change it |
| Submitted source code | Encrypted blob (AES-256-GCM, customer-namespaced KEK) | 90 days after final report — then deleted |
| Submitted scan addresses | Mongo (encrypted at rest) | Until you remove from Atlas |
| Audit reports | Encrypted at rest | Indefinite (you cite them for compliance) |
| Qelli chats | Mongo (encrypted at rest) | Until you delete the session |
| Billing data | Stripe (we never touch raw cards) | Per Stripe retention policy |
Who can read what
- Source code under audit — assigned engineer + one security reviewer + Owner James (break-glass, audit-logged). No one else.
- Scan addresses you've pinned — you + your team per RBAC.
- Qelli chats — you only; never used for model training (
no_logon our LLM gateway). - Audit reports — you + recipients you share with via signed URL.
Subprocessors (current list)
| Service | Purpose | Data shared |
|---|---|---|
| MongoDB Atlas | Primary store | All non-Stripe data |
| Stripe | Payments | Email + plan + billing address |
| Resend | Transactional email | Email + display name |
| Anthropic (Claude) | Qelli + audit-drafting LLM | Prompt content; no_log set |
| OpenAI | Doc embeddings only | Doc text (public docs only) |
| MaxMind GeoLite2 | Geo lookup for abuse detection | Inbound IP only |
| GitHub | OAuth login + repo access on customer consent | OAuth tokens scoped to repo |
| Cloudflare | DNS + DDoS edge | TLS-terminated traffic |
Live list at qortrace.com/legal/subprocessors. We commit to 30
days notice before adding any new subprocessor that touches
customer data.
Deleting your data
- Self-serve account deletion: Account → Settings → Delete Account.
- 30-day grace window during which you can restore.
- After grace: all PII + source code + scan addresses are hard-deleted within 7 business days. Audit reports remain hashed-stub for chain-of-custody integrity (no PII content).
Data residency
- Default region: US-East (AWS us-east-1).
- EU customers can elect EU-Frankfurt (AWS eu-central-1) at signup or via support request.
- Sovereign cloud options (US-GovCloud, AU, IN) on the Q4 2026 roadmap — Enterprise tier only.