QRNot DPP · Security

Where is your data, and how is it protected?

Straight answers to the questions our corporate customers’ information security and GDPR teams ask. If yours is not here, write to us.

Last updated: October 2026

Hosting and location

Application: Vercel cloud infrastructure. Server functions run in a US region; static content is served via a global CDN.
Database: Neon (PostgreSQL) in the AWS us-east-1 region (Virginia, USA).
Files: Product images and documents are stored in Vercel Blob with private access. Files cannot be opened directly; every request is served through our server after an authorisation check.
EU region: For customers who require data to be kept in the EU (Frankfurt), a region move can be arranged; please mention it when requesting a quote.

Encryption

In transit: All traffic is encrypted with HTTPS (TLS); HSTS tells browsers to use HTTPS only.
At rest: Our database provider Neon states that stored data is encrypted with AES-256 (Neon security documentation).
Passwords: User passwords are never stored in plain text; a salted scrypt hash is stored.
Sessions: Session tokens are stored only as SHA-256 hashes; the cookie is httpOnly and secure and expires after 14 days.

Access control

Company isolation: Every query is scoped to the signed-in user’s company; no company can see another company’s products, documents or supplier requests.
Roles: Owner, editor and viewer. Adding users, resetting passwords and company settings are owner-only.
Login protection: Repeated failed logins temporarily lock the account; panel and upload operations are rate-limited.
Authorised-access key: Sensitive passport fields such as suppliers, facility and notes are visible only with the key you share with authorities and recyclers. You can rotate the key at any time in the panel; the old key stops working immediately.
Supplier links: Unguessable, time-limited links. A supplier sees only their own request, and nothing is copied into a product without the company’s approval.

What data do we process?

Product data: The product, material, compliance and environmental information and documents you enter. This data does not need to contain personal data.
User data: Name, email address, role and last login time of panel users.
Passport scans: The IP address of the person scanning is not stored. Only country code, language and time are kept for statistics.
Supplier responses: The supplier’s company name, contact name and optional email, and the information and documents they submit.

Retention, export and deletion

Published passports: Not deleted but archived, as they must stay available for the product’s lifetime. Each publication is stored as an immutable version.
Drafts: Never-published products and their documents can be deleted permanently from the panel.
Export: Each passport is available as machine-readable JSON and serial numbers as CSV. At the end of the contract, all data is handed over in bulk on request.
End of contract: How long published passports remain available and when they are deleted is agreed in the data processing agreement.

Subprocessors

Provider	Purpose	Location
Vercel Inc.	Application hosting, file storage (Blob)	USA
Neon Inc.	Database (on AWS)	USA (us-east-1)
Anthropic PBC	Automatic translation — product texts are sent only when you request a translation	USA

Data processing agreement (GDPR / KVKK)

We sign a data processing agreement with corporate customers under GDPR Article 28 and Turkish KVKK. Because data is processed in the USA, which is an international transfer, the agreement follows the Standard Contractual Clauses (SCC) approach.

Request the data processing agreement

To be clear

QRNot itself does not hold ISO 27001 or SOC 2 certification. Our infrastructure providers publish their own certifications and compliance documents on their websites. We are happy to complete your security questionnaires.