Security, as a checklist.
Plain claims, each true today. Where a detail isn't settled yet, it's marked as pending rather than guessed.
Least access, drawn
- 01The public siteAnyone can read the catalogue and the demand board. Nothing behind it is reachable from here.
- 02Staff systemsQuarry staff sign in with SSO and multi-factor authentication, and get only the access a task needs.
- 03Dataset metadata and deliveryThe innermost door: each touch is logged with who, what and when. Raw source data is never behind it.
Encrypted the whole way.
Stored, moving and delivered: point at a stop to see what protects a record there.
- At restEncrypted where Quarry stores it.
- In transitTLS 1.2 or later on every Quarry endpoint.
- DeliveredPer-buyer bucket or a signed, expiring URL; SHA-256 per file.
01 Infrastructure
The website and public API run on Vercel.
Pending: Hosting region for systems that hold dataset metadata and delivery records: published here before launch.
Encryption in transit: TLS 1.2 or later on every Quarry endpoint.
Encryption at rest for everything Quarry stores.
Pending: Key management service: named here before launch.
Quarry never holds raw source data: de-identification runs in the owner's environment.
02 Access
Least privilege: staff and systems get the narrowest access a task needs, for as long as it needs it.
SSO and multi-factor authentication on every staff account.
Regular access reviews; access removed on role change or departure.
An audit log entry for every touch of a dataset: who, what, when.
03 Delivery
Datasets go to a per-buyer bucket or through signed, expiring URLs.
Every delivered file carries a SHA-256 checksum in the manifest, so the buyer can verify it.
No dataset or sample is ever sent as an email attachment.
04 Incident response
Detection through logging and alerting on the systems that hold dataset metadata and delivery records.
Affected owners and buyers are told without undue delay, on the timelines in the Data Processing Addendum and as the law requires.
Incident contact: security@quarrydata.ai.
05 Responsible disclosure
Report a vulnerability to security@quarrydata.ai; contact details are also at /.well-known/security.txt.
We acknowledge reports, keep you informed while we fix them, and credit you if you want credit.
Good-faith research that avoids privacy violations, data destruction and disruption will not be pursued by Quarry. Don't access data that isn't yours; if you do, stop and tell us.
Every touch leaves a line.
Each time a person or a system touches a dataset's metadata or a delivery, the audit log gets an entry: who, what, when. Scroll back through it the way an investigator would.
If something goes wrong.
Four steps, in order. Contact: security@quarrydata.ai.
- 01DetectLogging and alerting on the systems that hold dataset metadata and delivery records.
- 02ContainAffected access is withdrawn while the cause is found.
- 03NotifyAffected owners and buyers are told without undue delay, on the timelines in the DPA and as the law requires.
- 04ReviewWhat happened and what changes, written up once it is over.