Quoridea Security Overview

Draft for review. This document may change before paid plans open.

Version 0.1, 2026-10-27. Provider: Mitikasha LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States ("Quoridea", "we"). Security contact: security@quoridea.com.

This document describes how Quoridea protects customer data today. Where something is planned rather than built, it says so. It is Annex II (technical and organizational measures) of the Quoridea Data Processing Agreement.

1. What Quoridea is, and the data it holds

Quoridea is the system of record for an organization's innovation decisions: ideas, independent sealed scoring, named decisions, delivery tracking, a finance-validated benefits register and evidence packs. Customer data falls into three stores:

The directory holds no idea content, scores, decisions or amounts.

2. Hosting and data residency

• Quoridea runs entirely on Cloudflare's developer platform (Workers, Durable Objects, D1, R2, Browser Rendering, Email Service). There are no other servers, databases or analytics services.
• Each organization chooses its region (EU or US) at sign-up, and the region is fixed. The organization's tenant database is created inside the matching Cloudflare jurisdiction, which means it runs and stores data only within that region. The application refuses to open a tenant database without its jurisdiction.
• The directory is in the EU jurisdiction for all organizations. An organization in the US region therefore has its members' names, email addresses and roles stored in the EU.
• Files are stored in object storage created in the organization's jurisdiction (EU or US), like its database.
• Cloudflare's network serves requests from the data center nearest the user; data in transit to the stored region is encrypted (section 4).

3. Tenant isolation

• Physical isolation per organization. Each organization has its own database, not rows in a shared table. A query in one organization's database cannot read another's.
• Before any request reaches an organization's database, the application re-reads the signed-in account's current membership and roles from the directory. A removed member loses access on their next request.
• An account that belongs to several organizations chooses one at a time; that choice is never trusted on its own and is checked against current memberships on every request.
• Files are stored under a per-organization prefix and are served only after the same membership and permission checks as the idea they belong to.

4. Encryption

• In transit: all traffic is HTTPS. Quoridea sends Strict-Transport-Security (two years, including subdomains). Traffic between Cloudflare services is carried over TLS.
• At rest: encryption at rest is provided by Cloudflare for every store Quoridea uses. Cloudflare documents AES-256 for D1, R2 and Durable Object storage.
• Quoridea does not offer customer-managed encryption keys.

5. Identity and access for customer users

• Sign-in: email and password, or a one-time emailed sign-in link. Email verification is required before an account can sign in.
• Passwords: at least 12 characters; stored only as scrypt hashes. A password reset signs the account out everywhere.
• Sessions last 8 hours. Session cookies are HttpOnly, Secure and SameSite=Lax.
• Rate limits on sign-in (10 attempts per 5 minutes per IP address), sign-in links, sign-up, password reset and verification email.
• Tokens in emailed links (invitations, set-password, sign-in links) are single use, expire, and are stored only as SHA-256 hashes.
• Roles: administrators grant base roles only. Committee roles (reviewer, panel chair, changemaker) come only from audited appointments with fixed terms and separation of duties (for example, no sponsor reviews, no judge implements an idea they judged).
• Partner (consultant) access exists only by the customer's invitation, always carries an end date of at most 24 months, and can be ended by the customer at any time.
• Planned: single sign-on with Microsoft Entra ID and Google Workspace (in progress), SAML, multi-factor authentication, configurable idle timeout and re-authentication for administrative actions.

6. Governance controls built into the product

These are enforced on the server and each one has an automated test that fails if the control is removed:

• Sealed scoring: no score is visible to anyone but its author until the round closes.
• Named decisions: every decision records who decided and why.
• Conflict rules: no one reviews, decides on or validates benefits for their own initiative.
• Tamper-evident audit trail: every governance event is appended to a SHA-256 hash chain; each event includes the hash of the one before. Events cannot be edited or deleted through the application. Audit events never contain score values. The audit trail is visible to the organization's administrators.
• Finance separation: a funded idea is approved only after a finance validator, who is not the approver, has confirmed a budget.
• Configuration changes are versioned and audited; an open review round keeps the rules it opened with.

7. Application security

• Content Security Policy allows scripts, styles, fonts and connections from Quoridea's own origin only, blocks plugins and framing (frame-ancestors 'none', X-Frame-Options: DENY), and restricts form targets to Quoridea.
• Other headers on every response: X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, a Permissions-Policy that disables camera, microphone and geolocation.
• No third-party scripts, trackers, advertising or analytics run inside the application.
• File uploads: type checked by extension and file signature, at most 5 files of 10 MB per idea, a SHA-256 of each file recorded when the idea is submitted, downloads always delivered as attachments with nosniff.
• Spreadsheet import reads CSV and Excel files with hard limits on decompressed size, cells, rows and characters, and previews every row before anything is written.
• Outbound email is sent only from no-reply@mail.quoridea.com. Names entered by users are stripped of links and addresses before they appear in any email, so invitations cannot be used to send phishing from our domain. Notification emails carry titles, dates and links, never scores, amounts or reasons.
• No enumeration: sign-up and partner access requests give the same answer whether or not an address or domain belongs to an existing customer.

8. Secure development

• All code is TypeScript, reviewed and tested before deployment. The test suite (300+ automated tests) includes a test for each security and governance rule, and each such test is checked to fail when its rule is removed.
• An automated security review runs on every change; every finding to date has been fixed with a test.
• The release gate runs a dependency vulnerability audit (pnpm audit; high severity and above blocks the release), type checks, the full test suite and a build. It runs before changes are pushed and again inside the production pipeline. A secret scan runs on every push to the repository and blocks on any finding.
• Three environments: local, staging and production. Production deploys only through the CI pipeline and only code already promoted to staging; directory schema migrations are applied before code.
• Secrets (signing keys, provider credentials) are stored as encrypted Cloudflare Worker secrets, never in source code.
• Demo features (sample data seeding, demo personas) are disabled by configuration in production. The public demo at demo.quoridea.com is a separate deployment with its own databases and storage; it holds only a fictional company, has no customer accounts, and is wiped and rebuilt every night.

9. Operations, logging and monitoring

• Application errors and request logs are recorded in Cloudflare Workers Logs, with short retention set by Cloudflare's plan. The application never logs passwords, scores or amounts. Request logs record the URL, which for an emailed link includes its token; those tokens are single use and expire (sign-in links in 10 minutes).
• Planned: public status page.
• Personnel access to production is limited to a small number of authorized personnel of Mitikasha LLC, through Cloudflare and GitHub accounts protected by multi-factor authentication. (to be confirmed) Quoridea staff have no standing account inside any customer organization; partner advisors and support staff can enter an organization only when invited.

10. Backup and recovery

• Tenant databases support point-in-time recovery to any moment in the past 30 days.
• Directory: point-in-time recovery to any moment in the past 30 days.
• Files are stored in Cloudflare R2, which stores objects redundantly; there is no separate file backup.
• Planned: a documented and rehearsed restore procedure.

11. Data retention, export and deletion

• Customer data is kept for the life of the subscription.
• Evidence packs (ISO 56001 and EFQM) can be downloaded as HTML or PDF at any time.
• Planned: full self-service export of all organization data (JSON and files); deletion of an organization's database, directory entries and files within 30 days of the end of the contract, after which backups expire within a further 30 days, with a deletion certificate on request.

12. Incident response

• Suspected security incidents are reported to security@quoridea.com.
• We notify affected customers of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it, with the information they need for their own notifications.
• Vulnerabilities can be reported under our vulnerability disclosure policy; the contact is also published at https://quoridea.com/.well-known/security.txt.
• Planned: written incident response procedure.

13. Compliance

• Quoridea is not yet certified to ISO/IEC 27001 or attested under SOC 2. Certification is planned as the customer base grows; until then, this overview, our questionnaire answers and our DPA describe our controls.
• Our hosting provider, Cloudflare, maintains its own certifications and audit reports; see Cloudflare's Trust Hub.
• An independent penetration test is planned from the first Business-plan customer.
• Evidence packs produced by Quoridea are evidence supporting an innovation management system. They are not a certification or a claim of conformity.