Company · for IT and procurement
Trust & security
Your data is processed on the device and goes only where you send it.
How QBOID devices and QBOID Cloud handle data, where it is stored, the practices and policies behind it, and who else processes it. For the full policy documents, use the request form at the end of this page.
- Processing
- On the deviceworks offline; no cloud needed to measure
- Cloud region
- US or EUchosen at sign-up; data stays there
- Ownership
- You own your dataQBOID doesn't sell operational data
- Network
- Outbound onlyconnections over TLS; proxy support
How data flows
On the device first. Then where you choose.
Every measurement is computed on the M2. Nothing leaves the device unless you set a destination.
Processed on the device
Dimensions are calculated on the M2 itself. It works fully offline; no cloud connection is needed to measure.
Stored on the device
The Item & Parcel and Pallets apps keep each scan on the device by default, protected by Android full-disk encryption. You set the clean-up rules.
You choose the destination
QBOID Cloud, your own WMS, ERP or HTTPS endpoint, both, or nowhere. Data sent only to your endpoint never reaches QBOID.
No remote access
QBOID can't access data on your devices remotely. We see device data only if you send it to QBOID Cloud or share logs with support.
The devices don't collect names, payment card data, health information or GPS location. WorkFlows apps store data on the device only if the app is set up to. Source: the product Privacy Policy ↗, sections 2 to 5.
Data regions and hosting
Two regions. Your data stays in yours.
QBOID Cloud runs as two separate instances. You pick one when you set up your account.
Region
United States
Data stored and processed in the US.
customers.qboid.aiRegion
European Union
Data stored and processed in the EU. Operational data isn't transferred to the United States.
eu.customers.qboid.aiHosting Wording to confirm
Amazon Web Services
QBOID Cloud is hosted on AWS, whose infrastructure holds SOC 2 and ISO 27001 certifications. Those certifications are AWS's; QBOID doesn't hold its own.
- Encrypted in transit with TLS, and at rest with the platform's encryption
- Each customer account is isolated from the others by application-level access controls
- Separate test and production environments
- Dedicated infrastructure is available on request
- Development staff in the EU have no access to customer data, production systems or deployed devices
- Exports in XLS, or ZIP with images, at any time
Security practices
What we do to protect it.
The practices below are public. Infrastructure detail is in the full documents, on request.
On the device
- Android full-disk encryption, on by default
- App sandboxing and OS access controls
- Works with MDM tools such as SOTI
On the network
- TLS for all traffic
- Outbound connections only; proxy support
- Optional bearer token for your endpoint; CA-issued or self-signed certificates
In development
- Development aligned with OWASP guidance
- Regular security patches and updates
- Restricted administrative access
In the organisation
- Written security policies, reviewed every year
- Security training and incident response procedures
- Media disposal aligned with NIST SP 800-88
Licence check-in. The device validates its app licence when the app starts and about once a day, with a limited grace period when it's offline. The check sends licence information only: dimensioning data is never sent for licence validation.
Policies
Five written policies.
A short summary of each here; the full documents go out on request, for security reviews and vendor assessments. A2: public summaries vs full documents, to confirm
Information Security Policy
How QBOID protects information and systems: access, encryption, incident response and staff responsibilities.
Full document on request
Business Continuity Policy
How QBOID keeps services running through a disruption, and how they are restored.
Full document on request
Vulnerability and Patch Management Policy
How security issues in our software and systems are tracked, prioritised and patched.
Full document on request
Secure Development Policy
How device, app and cloud software is designed, reviewed and tested, in line with OWASP guidance.
Full document on request
Media Disposal Policy
How storage media and devices that held data are wiped or destroyed, in line with NIST SP 800-88.
Full document on request
Request the documents
Tell us your company and which policies you need; sales replies within one business day.
Request security documentsSubprocessors
Who else processes data.
The service providers QBOID uses, and the data each one handles. Counsel review
| Provider | Purpose | Data |
|---|---|---|
| Amazon Web Services | QBOID Cloud hosting, in the US or EU region | Records and images you send to QBOID Cloud; Cloud account details |
| Google Workspace | Business email and documents | Business contact details and correspondence |
| Microsoft 365 | Business email and documents | Business contact details and correspondence |
| HubSpot | Customer relationship management, website forms and email | Business contact details and interaction history |
| Shopify | Online store and payments | Order, billing and shipping details; payment cards are processed by Shopify |
Data you send to your own endpoint, or through a reseller or integration partner you choose, is governed by your arrangement with them.
Availability and payments
Plain terms on uptime and cards.
What the QBOID Cloud terms say, and how store payments work.
Availability
QBOID Cloud is run on a best-effort basis, without a formal uptime SLA. Scheduled maintenance is usually on a Sunday night, about once a month. Devices keep measuring and storing scans when the Cloud or the network is unavailable, and sync over Wi-Fi once the connection is back.
Cloud Basic keeps a rolling 30 days of history, so export the records you need to keep, or send them to your own systems.
Payments
Payments in the QBOID store ↗ are processed by Shopify. QBOID never stores payment card data, and the devices and QBOID Cloud don't collect it.
Report an issue · Legal documents
Found a vulnerability?
Email security@qboid.ai with "Security Issue" in the subject, and include what you found and how to reproduce it. To confirm
Reviewer note (B13): the product Privacy Policy currently sends security reports to support@qboid.ai. One address is to be chosen, used here and in the Privacy Policy, and published in a security.txt file.
- Website privacy policyHow qboid.ai and its forms handle visitor and contact data.
- Product Privacy Policy ↗Devices, apps and QBOID Cloud: data collected, storage, regions, security and your rights.
- MSA Exhibit C: QBOID Cloud ↗Cloud tiers, retention and export, support, availability, API and infrastructure.
- Terms and product legal documentsTerms of Service and the hardware, software and cloud exhibits.
Security review · Vendor assessment
Request security documents.
Tell us your company and which documents you need, and sales will reply within one business day.
- Full policy documents for security reviews and vendor assessments
- Sales replies within one business day
- Or book a 20-minute remote demo on items you choose
Or write to sales@qboid.ai, or call +1 (408) 419-1449.