Security
Built by a security practice, for firms whose clients ask hard questions
Your proposals hold your clients' scope and your commercials. These are the controls that protect them.
Tenant isolation in the database
Every business table carries the organisation it belongs to, and Postgres row-level security enforces the boundary. A missed filter in code cannot leak one firm's data to another.
Strong sign-in for everyone
Invite-only accounts, Argon2id password hashing, mandatory authenticator codes and passkeys. Platform administrators must use passkeys.
Operators cannot read your data
Platform staff manage organisations, not their business records. Support access is approved, time-boxed, read-only and audited.
A full audit trail
Who changed what, when and from where, for every record. Signed-in sessions can be reviewed and ended at any time.
Documents that cannot change
Issued proposals and invoices are kept as immutable snapshots in write-once storage, with a hash recorded at acceptance.
Hosted in India
Qryti runs in Microsoft Azure's Central India region behind a web application firewall. Data is encrypted in transit and at rest; secrets live in Key Vault.
Backups we restore
Automated backups with a restore drill we actually run, because untested backups are not backups.
Least privilege by design
Permission-based access with five standard roles, section-level edit rights on proposals and custom roles on higher plans.
Secure development
Security scanning gates every change, and an external penetration test runs before every major release.
Reporting a vulnerability
Email security@qryti.comwith what you found, how to reproduce it and the impact you believe it has. We acknowledge reports within 2 working days, fix critical issues within 7 days and credit researchers unless they ask us not to. Research that stays within your own workspace and avoids harm to others is welcome.
Have a security questionnaire?
Book a call and we will walk your team through our architecture and controls.