Privacy contact: [email protected].
Access follows workspace membership.
The application uses managed identity in live configuration and application-owned workspace permissions. Owner, Admin, Rep, and Viewer are distinct roles. A valid identity does not itself grant access to a customer workspace. Reps are limited to assigned inquiries and eligible claim pools; Viewer access is explicitly workspace-wide.
The database design uses tenant-scoped transactions, row-level security, and tenant-bound references. Privileged actions require the appropriate role and fresh authentication where specified. Production must reject development authentication and synthetic entitlements.
External actions have an explicit boundary.
Signed source requests and provider callbacks are validated before acceptance. Credentials are kept server-side, encrypted where later use requires the original, and excluded from public builds. The source-signing secret never belongs in browser JavaScript.
Simulation and shadow runs do not authorize production workflow effects. CRM updates and Slack messages have durable intents and explicit delivery states. An uncertain external result needs reconciliation; local uniqueness does not guarantee exactly-once behavior in another system.
Data use stays narrow.
Optional enrichment begins disabled. A provider needs permitted processing and output rights, an allowed purpose, and a separate budget authorization. Optional model assistance receives bounded allowed information and cannot change financial authorization or choose an owner.
The public site does not need tenant database credentials and contains no customer records. There are no advertising pixels, session replay tools, or fingerprinting scripts in the initial site.
Recovery preserves privacy boundaries.
Privacy suppression and recovery procedures require deletion records to be reapplied before restored data becomes available for access or outbound work. Backup retention and recovery arrangements are part of the applicable service setup. This site makes no contractual availability guarantee.
Support access to customer content requires a recorded customer-authorized scope, reason, and expiry. There is no standing claim of unrestricted support browsing.
Ask about data handling.
QualiRelay uses a hosting provider and the service providers described in the provider register. Information may be processed outside a customer’s jurisdiction under applicable safeguards; the privacy notice explains how to request more information.
No SOC 2, ISO, platform-wide PCI certification or universal compliance claim is made. Contact our Privacy Officer at [email protected] or request privacy assistance for a data-handling question. For general service questions, use [email protected].