Security
Quantity surveying records carry contractual weight. Here is how we treat them, stated plainly and without badges we have not earned.
Encryption in transit and at rest
The app is served over HTTPS. Several commercial workflows remain local-first in your browser. Server-backed structured records use encrypted Neon Postgres and cloud file objects use encrypted Cloudflare R2. Secrets are held in deployment configuration and are blocked from commits by the repository scanner.
Data locations stated plainly
Several commercial records stay on your own device. Structured hosted project records use Neon Postgres in London. Cloud file objects use an R2 bucket whose current location reports Western Europe (WEUR); automatic placement is not a single-country jurisdiction guarantee. Obedience Cloud application servers run in Germany (EEA).
UK GDPR by design
Data minimisation, purpose limitation and subject rights are designed in, not bolted on. See the Privacy Policy for the full detail.
Least-privilege access
Role-based permissions split authoring from approval, mirroring professional accountability. Server-backed database records use workspace-scoped access and row-level controls, while local-first records remain isolated to the current browser profile unless deliberately exported or uploaded.
Auditability as a feature
The variation audit trail is append-only in the app and remains device-local with the related commercial record. Server-backed document and AI workflows create their own scoped audit records. A company-wide tamper-evident event service is still a roadmap control and is not claimed as live.
Independent certification: planned
We are honest about maturity: formal certifications such as SOC 2 are on the roadmap as the company grows, and this page will state exactly what has been achieved, when.
Built for the RICS responsible-AI standard
RICS published its first mandatory global professional standard on the responsible use of AI in surveying practice in September 2025, in force since 9 March 2026. If you are RICS-regulated, you now carry due-diligence, client-disclosure and quality assurance duties whenever AI touches your work. QuantifyQS is designed so those duties are meetable, not obstructed:
- · AI assists, humans author. Nothing client-facing is generated for signature; suggestions are drafts you edit and own.
- · Every record is attributable. Gates, versions and edits carry who and when at the moment they happened, so your QA duty has an evidence trail.
- · AI answers will cite their sources. The commercial search we are building returns citations into your own record, and “not found in the record” is a first-class answer.
- · Your data trains nothing. Client-confidential records are never used to train models and never leave the processing needed to answer you.
This describes how the product is designed. It is not a certification, and your professional obligations under the standard remain your own.
Found a vulnerability? Email security@obedience.global and we will respond within two working days.