Overview
QuantPass is built on AWS infrastructure with security controls designed to support SOC 2 Type 1 certification. This page describes the controls currently in place, the evidence collected to date, and the current certification status.
Current status: SOC 2 Type 1 audit preparation is approximately 70% complete. Evidence collection is underway. Auditor engagement is planned for Q3 2026, pending internal approvals. A SOC 2 Type 1 report is targeted for Q1 2027.
Enterprise prospects who require a SOC 2 report before that date are encouraged to contact us at hello@quantcert.ai to discuss interim security documentation and a shared responsibility model.
Infrastructure Security
QuantPass runs entirely on AWS (us-east-2) using a serverless architecture: API Gateway, Lambda, DynamoDB, S3, and Cognito. There are no long-lived servers, no unpatched operating systems, and no persistent compute instances to maintain. The attack surface is materially smaller than traditional server-based architectures.
All infrastructure is defined as code (Terraform + AWS CloudFormation / Serverless Framework) and deployed through a controlled change management process. Every Lambda function version is tracked with a last-modified timestamp as part of the change management evidence record.
Controls in Place
The following SOC 2 Trust Service Criteria controls have documented evidence collected for the period April 6 – May 6, 2026:
CC6.1 — Logical and Physical Access Controls
Access to QuantPass systems is controlled through AWS Cognito with MFA enforced, IAM roles with least-privilege policies, and password complexity requirements. Evidence collected: Cognito user pool configuration, IAM role policies, MFA enforcement status.
CC6.7 — Data Encryption
All data at rest is encrypted. DynamoDB tables use AWS-managed server-side encryption (SSE). S3 buckets use AES-256 encryption. Vault credentials are additionally encrypted client-side before transmission using ML-KEM-1024 key encapsulation — the server never receives plaintext credential data. Evidence collected: DynamoDB SSE configuration, S3 encryption settings.
CC7.1 — Threat Detection
AWS GuardDuty is enabled and actively monitoring for threats across all QuantPass AWS accounts. GuardDuty findings are reviewed as part of the monthly security operations cadence. Evidence collected: GuardDuty detector status and findings summary.
CC7.2 — Anomaly Alerting
CloudWatch alarms are configured to alert on Lambda error rates, DynamoDB throttling, and API Gateway 5xx error spikes. Alerts route to the engineering on-call channel. Evidence collected: CloudWatch alarm configurations and threshold settings.
CC8.1 — Change Management
All Lambda function deployments are versioned. Last-modified timestamps are tracked for every production function as part of the change management audit trail. Infrastructure changes go through code review before deployment. Evidence collected: Lambda version history and last-modified timestamps across all production functions.
A1.2 — Availability Monitoring
Lambda RED metrics (rate, errors, duration) are collected and retained for the full evidence period. API Gateway request metrics provide end-to-end availability visibility. The serverless architecture provides inherent horizontal scaling without manual intervention. Evidence collected: Lambda rate/error/duration metrics, April 6 – May 6, 2026.
Comparison
Encryption Summary
| Layer | Mechanism | Standard |
|---|---|---|
| Data in transit | TLS 1.3 | Industry standard |
| Data at rest (DynamoDB) | AWS SSE (AES-256) | Industry standard |
| Data at rest (S3) | AES-256 | Industry standard |
| Vault credentials | ML-KEM-1024 client-side | NIST FIPS 203 |
| Authentication signatures | ML-DSA-44 | NIST FIPS 204 |
Penetration Testing
External penetration testing is planned as part of the SOC 2 audit preparation process (Q3 2026). Results will be shared under NDA with enterprise prospects on request.
Data Handling
What QuantPass collects
- Authentication event metadata (timestamp, domain, cryptographic scheme used, risk score)
- Encrypted vault blobs (plaintext credentials are never transmitted to or stored on QuantPass servers)
- Enterprise provisioning metadata (usernames, email addresses, group memberships — sourced from your IdP via SCIM)
What QuantPass does not collect
- Plaintext passwords or credentials
- Browser history or page content
- Keystrokes or mouse activity
- Personal data beyond what is necessary for authentication and provisioning
Data residency
All QuantPass data is stored in AWS us-east-2 (Ohio). Enterprise customers requiring data residency in other regions should contact us to discuss deployment options.
Data retention
Authentication event logs are retained for 90 days by default. Retention periods are configurable for enterprise customers with specific compliance requirements.
Responsible Disclosure
If you discover a security vulnerability in QuantPass, please report it to security@quantcert.ai. We commit to acknowledging reports within 24 hours and providing a resolution timeline within 72 hours. We do not pursue legal action against researchers who act in good faith.
Questions
For security questionnaires, penetration test results, or compliance documentation requests, contact hello@quantcert.ai. We typically respond within one business day.