How we protect your data
- Encryption — data is encrypted in transit with TLS and at rest.
- Tenant isolation — each workspace’s data is isolated using PostgreSQL row-level security.
- Least privilege — internal access is scoped and granted only as needed to run the service.
- US hosting — the service and your data are hosted in the United States.
- Quoqo-managed AI — contract analysis runs on Quoqo’s own managed LLM service, not a public AI chat product.
- No training on your content — your content is processed transiently and is never used to train or fine-tune any model.
Subprocessors
Contract analysis is performed by Quoqo’s own managed LLM service. The vendors below support hosting, storage, and payments.
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Cloudflare, Inc. | Object storage (R2) | Uploaded documents and generated artifacts | United States |
| Railway Corp. | Application hosting, database, queue | Application data (accounts, analyses, metadata) | United States |
| Stripe, Inc. | Payments and billing | Billing and account data — never contract content | United States |
Reporting a vulnerability
If you believe you have found a security issue, please email sales@quoqo.com. We appreciate responsible disclosure and will work with you on a fix.
Changes
We update this page when our practices or subprocessors change. The date above reflects the latest revision.