security qioi audit --practices
Controls we can enumerate, not adjectives.
Security at QIOI is a list of specific, verifiable practices applied to every managed instance — not a badge wall. Here is the list.
practices — applied to every deployment
[ok] secrets stored encrypted at rest
[ok] no plaintext api keys in logs
[ok] short-lived credentials where possible
[ok] audit logging on administrative actions
[ok] rate limiting on public endpoints
[ok] csrf protection on dashboard sessions
[ok] secure, http-only cookies
[ok] input validation on all user-supplied data
[ok] backup encryption
[ok] least-privilege provider credentials
[ok] separate production and staging environments
[ok] secure deletion on instance teardown
[ok] role-based access within organizations
[ok] organization-level data separation
[ok] email verification on new accounts
[ok] multi-factor authentication support
provider root credentials are held by qioi operations and are never exposed to application instances.
scope — an honest note
what qioi does not claim
QIOI is designed with security and privacy controls, as listed above. QIOI does not claim SOC 2, ISO 27001, HIPAA, or GDPR certification. If your organization requires a certified vendor, we will tell you directly whether we are the right fit — and what controls exist today versus what is on the roadmap.