sessions
HTTP-only cookies
// legal
Security posture.
Quanta keeps public security statements tied to controls that are already present in the product.
passwords
bcrypt hashes
demo
read-only
Authentication
Password authentication stores bcrypt hashes. Production sessions use HTTP-only, Secure, SameSite=Lax cookies.
Access control
Personal, Tax, Trader, and Admin access are tiered. Protected workspaces and server routes enforce tier checks.
External credentials
Plaid handles bank credential collection. Quanta receives the tokens and account data needed to sync supported accounts.
Security contact
Security questions, suspected vulnerabilities, and diligence requests can be sent to the security inbox for review.
- ▒ security@quanta.app