Security and your data

How your documents are protected

Two independent layers guard every document

Server-side authorization rules govern every file and folder: a read requires that you own it, administer the organization that owns it, were named on a share, or belong to an organization the file was explicitly shared with. Separately, the file bytes are never directly readable at all. Storage rules deny direct reads outright, so no public or guessable download URL can exist, and every byte is served through an authenticated proxy that re-checks permissions before streaming.

Sponsors see the scoreboard, never the work

If your organization joined through an enterprise or cohort sponsor, that sponsor sees aggregate counts and readiness scores, along with member names and emails. They cannot reach your documents or proposals, and there is no code path that would let them. You can choose to share a specific file with them, and that share is yours to make and yours to revoke.

Your data stays in the United States

Files are stored in the United States, in a multi-region configuration. There are no signed URLs and no publicly reachable customer objects.

We never touch your card

A PCI-compliant payment processor handles payment entirely. Quillify does not see or store card numbers. Everything underneath runs on managed enterprise cloud infrastructure, with data encrypted in transit and at rest.

If you are the person doing diligence

The privacy policy sets out what is collected, what it is used for, and the categories of processor involved, along with your rights as a California resident or under GDPR. The FAQ answers the shorter versions of most of this.

Send your security questionnaire to our team and we will work through it in the same detail as this page, including anything here you want evidenced.