Quantlix · Trust center
Security, compliance posture, and data-flow transparency for procurement and security reviews.
Readiness, not legal compliance
Quantlix provides runtime policy enforcement and exportable evidence on supported production paths to help teams build EU AI Act readiness and broader AI governance workflows. It is not legal advice, a conformity assessment, CE marking, or a guarantee of regulatory compliance. Risk classification, DPIAs, and legal interpretation remain your responsibility.
Preparation underway; the Type II observation window opens 1 Nov 2026 and the report follows the examination (expected Q2 2027), available under NDA. Not certified today. Separately, customers can already generate SOC 2-scoped evidence bundles for their own examinations — Quantlix evidences the AI-runtime slice; only a licensed CPA firm attests.
Request audit report →Information security management system certification planned after SOC 2 Type II.
Data subject export, deactivation, and erasure flows with audit logging. Standard DPA available.
Data Processing Agreement →Managed Quantlix cloud runs on EU infrastructure (Hetzner). Self-hosted Kubernetes available for stricter boundaries.
Encryption, access, incidents, and vulnerability management for reviewers.
Tamper-evident chaining, Rekor anchoring, and independent verification with the bundled standalone verifier.
Live list of infrastructure and service providers.
Current operational status of Quantlix services.
Report vulnerabilities to our security team.
Download our standard DPA or request execution.
Request SOC 2 evidence when available.
| Party | Role | Regions | Data categories | Notes |
|---|---|---|---|---|
| Source code hosting and CI | US, EU | source_code, ci_metadata | — | |
| Cloud infrastructure (managed Quantlix hosting) | EU | customer_payloads, operational_logs, account_metadata | — | |
Model providers you configure Customer-configured | Inference (OpenAI, Anthropic, Azure OpenAI, Bedrock, etc.) | varies | prompts, completions, embeddings | Customer-selected; data flows per deployment provider binding and DPA. |
| Secondary blockchain timestamp for trace chain Merkle roots | global | sha256_merkle_root_digests | Optional redundancy alongside Rekor; digest-only submissions. | |
| Transparency log for trace chain Merkle roots (hashedrekord; digest only) | US, EU | sha256_merkle_root_digests | Enterprise trace chain anchoring when TRACE_CHAIN_ANCHOR_ENABLED is on. No tenant identifiers in public log entries. | |
| Payment processing and billing | EU, US | billing_pii, payment_metadata | — | |
| Customer-configured | Embeddings and semantic retrieval | US | text_for_embedding | Only when used for RAG or semantic cache. |
Company & hosting
Quantlix is operated by Navego AB, Lillängsvägen 21, 131 41 Nacka, Stockholm, Sweden.
Questions for security or compliance reviews: security@quantlix.ai