The /security page describes the architecture and controls. This page is the itemized list of documents behind that description — what each one covers, who it's written for, and how to get it.
The security docs pack is the set of documents a reviewer needs to evaluate QuietNode before deployment: what is enforced in code, what is stored and for how long, and where the platform's own claims come from.
No bundled zip of unrelated PDFs. Each item below is a specific, current document — request the whole pack or ask for the ones relevant to your review.
QuietLens BI · AI data analyst
Each implemented control, including the hash-chained audit log and the SELECT-only SQL gate, mapped to common security frameworks and linked to the code and test behind it. A mapping, not an audit or a certification.
QuietLens BI · AI data analyst
Exactly what is stored (users, workspaces, conversations, connector config, audit events), where, and for how long, including the optional PII-redaction and idle-conversation purge settings.
QuietLens BI · AI data analyst
A DPA template, on request, describing the customer-VPC deployment model: QuietNode hosts nothing and never holds a customer credential.
QuietLens BI · AI data analyst
The deployment topology and trust boundaries: the customer-VPC container, the read-only svc-quietlens identity, connector data flows — and the separation from QuietMend: the two products share no deployment, credential, or network.
QuietLens BI · AI data analyst
How the golden eval is produced: the deterministic engine scores 149 of 149, published with each release. It covers the diagnosis journey, not the LLM-assisted path. An ungrounded number fails the release build.
QuietLens BI · AI data analyst
Each release attaches an SBOM and the eval scorecard. The image is signed, with provenance the customer can verify. Image access is granted per evaluation.
QuietMend · AI data engineer
The design: a plan and an access request on the ticket, a human approval, then short-lived access scoped to the ticket, in DEV only. QuietMend is in development and has never run against live systems.
QuietMend · AI data engineer
The deny-by-default policy design and its evaluation against fixtures: 90 of 90 cases, including 50 of 50 attack cases denied. A mapping of the design, not an audit.
The pack is request-gated, not a public download — that keeps it current and lets me point you at the documents that matter for your review instead of everything at once.
Who it's for
Security reviewers
Evaluating QuietNode ahead of deployment — architecture, access model, and enforced controls.
Compliance & procurement
Building a vendor risk file and need the control mapping, the data-handling policy, and a DPA template on request.
Engineering leads
Who want to see what is enforced in code and tested in CI, not asserted in a sales deck.
How delivery works
Choose “Security review” in the contact form and note what you’re evaluating.
The person building the product replies personally — no ticket queue, no handoff to sales.
Matched to your review — the relevant documents, sent directly.
Pick “Security review” in the contact form and note what you’re evaluating. A founder replies with the relevant documents — no download link, no ticket queue.