Security & tenant isolation

Every record in QualityIris carries the identity of the organisation it belongs to, and the database itself refuses to return rows that belong to anyone else. This is row-level security: the rule lives in the database engine, not in application code.

The practical consequence matters if you are a buying office sharing a platform with your competitors. There is no screen, no export, no report and no API call that can return another organisation’s orders, inspections, photos or measurements — because the request never gets past the database. A mistake in a page or a query cannot widen that boundary; the database would simply return nothing.

We maintain an internal cross-tenant test suite that deliberately attempts to read one organisation’s data while signed in as another, across every table that holds customer content — orders, inspections, audits, corrective actions, measurement specs, checklists, photos, users and notification records.

These tests run automatically on every release. If any of them ever succeeded in reading data across the boundary, the build fails and the release does not ship. The isolation guarantee is therefore not a one-off review: it is re-proven every time the product changes.

Within an organisation, access is scoped by role: administrator, QA manager and inspector. Buyer and factory users invited from outside your team are strictly read-only, are matched only to the specific buyer or factory records they are entitled to see, and are kept out of internal KPI and analytics views entirely.

Deleting an order or an inspection is a reversible, audited action rather than a silent removal, so records cannot quietly disappear from the trail.

All traffic between your browser and QualityIris is encrypted with TLS. Customer content, including inspection photos and signatures, is stored in a managed, encrypted cloud database and object store in a managed region, with automated backups.

Passwords are never stored in readable form, sessions time out after a period of inactivity, and new users are required to set their own password on first sign-in.

The database is backed up automatically every day, encrypted, and each backup is retained for up to 14 days. Uploaded files — inspection photos, signatures and generated PDF reports — are held in managed, encrypted object storage and rely on that platform’s own durability guarantees.

Deleting an order or an inspection inside the app is a soft delete: the record leaves your screens but stays recoverable, and customer content is retained for 90 days after an account ends before it is permanently removed.

We would rather be precise about the limits than reassuring about them. Today we do not keep an independent second copy of uploaded files, we make no claim of geographic redundancy, and we hold no security certification. A formal, drill-tested recovery programme — including a second archive copy of every uploaded file and quarterly restore exercises — is on our roadmap, and we are happy to walk through the current position in detail under NDA.

If you believe you have found a security issue, we want to hear about it before anyone else does. Write to abuse@qualityiris.com and we will acknowledge your report. Our machine-readable contact details are published at /.well-known/security.txt.

We will not pursue legal action against researchers who report issues in good faith, act only against their own test account, and give us reasonable time to fix the issue before disclosing it.

What we collect, how long we keep it, who processes it on our behalf, and how to have it deleted are all set out in full in our legal documents rather than summarised here.

See the Privacy Policy, the Data Processing Agreement (which lists our sub-processors and covers GDPR, UK GDPR and CCPA), and the Terms of Service. Your organisation’s data remains yours, and it is exportable for 90 days after a subscription ends.