Skip to content
Security & trust

The controls behind your customers' data.

Quikdealer holds finance data, signatures, and identity documents for dealerships in two countries. This page is the operational detail — written for the person whose job it is to ask.

Book a technical reviewCompliance frameworks

Security contact: security@quikdealer.com

Architecture

How the system is put together

Isolation, encryption, and the audit record are structural properties here, not features that can be switched off by a misconfiguration.

Tenancy & access

  • Every domain table carries a dealership ID, enforced NOT NULL from the first migration.
  • Row-level security policies are written per command — separate SELECT, INSERT, UPDATE, and DELETE rules — so a soft-deleted row can't leak through a blanket policy.
  • Role-based access control spans 160+ permissions across 16 role templates, instantiated per dealership rather than shared globally.
  • Application tokens live in HttpOnly cookies and reach the API through a server-side proxy; no JWT is ever readable from browser JavaScript.
  • Two-factor authentication with authenticator apps and single-use backup codes is available to every user, with an organisation-wide enforcement switch.

Data protection

  • Driver's licence numbers and integration credentials are column-encrypted with pgcrypto under a key derived per dealership.
  • Money is stored as integer cents with an explicit currency, so rounding and currency confusion can't silently corrupt a ledger.
  • Customer-facing documents render bilingual or French-first for Québec tenants from the same pipeline that produces the signed copy.
  • Consent text is persisted verbatim at the moment of capture, alongside the purpose it was given for.

Audit & integrity

  • The audit log is append-only: UPDATE, DELETE, and TRUNCATE are revoked at the database, not merely avoided in code.
  • Entries are hash-chained, and the chain is sealed on a daily job with a signing key.
  • Verification reports the exact point at which a chain fails, so tampering is locatable rather than just detectable.
  • Signing envelopes record access-code verification, every view with IP and user agent, signature, and decline reasons.

Operations & monitoring

  • Liveness and readiness are separate endpoints, so a degraded dependency doesn't get traffic routed to it.
  • The OFAC sanctions list refreshes daily and alerts when no refresh has succeeded in 36 hours.
  • Background workers and syndication channels report health; unhealthy channels raise alerts rather than failing quietly.
  • Errors and worker failures are reported to an alerting pipeline with environment separation.
Cadence

How often each control runs

A control nobody runs on a schedule is a control you don't have.

ControlCadence
Audit chain sealDaily; full verification on regulator export
OFAC list refreshDaily, with an alert past 36 hours
BackupsDaily, with daily and monthly retention
Access reviewMonthly for internal accounts; on request for dealerships
Secret rotationOn incident, privileged departure, or vendor change
Dependency updatesContinuous, with security advisories prioritised
Your data

Where it lives, and how you get it back

It stays yours

Your records are exportable at any time. We don't hold your data hostage to a renewal conversation, and there's no fee to leave with it.

Export and erasure are built in

PIPEDA requires data-subject access and erasure, so the machinery exists as a product feature. The same machinery answers your own export requests.

Backups are tested, not assumed

Daily backups with daily and monthly retention. A backup nobody has restored is a hypothesis, so restores are exercised rather than trusted.

Isolation survives a mistake

Because tenant isolation is enforced by database policy rather than a query filter, an application bug can't turn into a cross-tenant data exposure.

What we haven't done yet

Vendor security pages usually only list wins. Here's the current state plainly, so nobody discovers it during procurement instead.

  • Quikdealer does not hold a SOC 2 or ISO 27001 certification today. The controls on this page are implemented and running; they have not been through a third-party attestation.
  • Single sign-on with an external identity provider isn't available yet. Access is Quikdealer accounts with optional two-factor and organisation-wide enforcement.
  • We'll answer a security questionnaire, walk an architecture review, and put any of the above in writing before you commit to anything.

Responsible disclosure

If you've found a vulnerability, tell us before you tell anyone else and we'll work it with you. We don't pursue researchers acting in good faith, and we'll credit you if you'd like us to.

Report a vulnerability →

Bring your questionnaire

We'd rather answer a hard security review early than discover a blocker at signature. Send it over, or book a session with the people who built this.

Book a technical reviewCompliance frameworks