Store (opens in a new tab) Get in touch Book a demo

Company · for IT and procurement

Trust & security

Your data is processed on the device and goes only where you send it.

How QBOID devices and QBOID Cloud handle data, where it is stored, the practices and policies behind it, and who else processes it. For the full policy documents, use the request form at the end of this page.

Request security documents How data flows
Processing
On the deviceworks offline; no cloud needed to measure
Cloud region
US or EUchosen at sign-up; data stays there
Ownership
You own your dataQBOID doesn't sell operational data
Network
Outbound onlyconnections over TLS; proxy support

How data flows

On the device first. Then where you choose.

Every measurement is computed on the M2. Nothing leaves the device unless you set a destination.

M2: processed on the deviceStored on the deviceQBOID CloudYour endpointBothNowhere

Processed on the device

Dimensions are calculated on the M2 itself. It works fully offline; no cloud connection is needed to measure.

Stored on the device

The Item & Parcel and Pallets apps keep each scan on the device by default, protected by Android full-disk encryption. You set the clean-up rules.

You choose the destination

QBOID Cloud, your own WMS, ERP or HTTPS endpoint, both, or nowhere. Data sent only to your endpoint never reaches QBOID.

No remote access

QBOID can't access data on your devices remotely. We see device data only if you send it to QBOID Cloud or share logs with support.

The devices don't collect names, payment card data, health information or GPS location. WorkFlows apps store data on the device only if the app is set up to. Source: the product Privacy Policy ↗, sections 2 to 5.

Data regions and hosting

Two regions. Your data stays in yours.

QBOID Cloud runs as two separate instances. You pick one when you set up your account.

Region

United States

Data stored and processed in the US.

customers.qboid.ai

Region

European Union

Data stored and processed in the EU. Operational data isn't transferred to the United States.

eu.customers.qboid.ai

Hosting

Amazon Web Services

QBOID Cloud is hosted on AWS, whose infrastructure holds SOC 2 and ISO 27001 certifications.

  • Encrypted in transit with TLS, and at rest with the platform's encryption
  • Each customer account is isolated from the others by application-level access controls
  • Separate test and production environments
  • Dedicated infrastructure is available on request
  • Development staff in the EU have no access to customer data, production systems or deployed devices
  • Exports in XLS, or ZIP with images, at any time

Security practices

What we do to protect it.

The practices below are public. Infrastructure detail is in the full documents, on request.

On the device

  • Android full-disk encryption, on by default
  • App sandboxing and OS access controls
  • Works with MDM tools such as SOTI

On the network

  • TLS for all traffic
  • Outbound connections only; proxy support
  • Optional bearer token for your endpoint; CA-issued or self-signed certificates

In development

  • Development aligned with OWASP guidance
  • Regular security patches and updates
  • Restricted administrative access

In the organization

  • Written security policies, reviewed every year
  • Security training and incident response procedures
  • Media disposal aligned with NIST SP 800-88

License check-in. The device validates its app license when the app starts and about once a day, with a limited grace period when it's offline. The check sends license information only: dimensioning data is never sent for license validation.

Policies

Our main policies, in short.

A short summary of the main written policies behind these practices. The full documents go out on request, with a completed security questionnaire if your review needs one.

Information Security Policy

How QBOID protects information and systems: access, encryption, incident response and staff responsibilities.

Full document on request

Business Continuity Policy

How QBOID keeps services running through a disruption, and how they are restored.

Full document on request

Vulnerability and Patch Management Policy

How security issues in our software and systems are tracked, prioritized and patched.

Full document on request

Secure Development Policy

How device, app and cloud software is designed, reviewed and tested, in line with OWASP guidance.

Full document on request

Media Disposal Policy

How storage media and devices that held data are wiped or destroyed, in line with NIST SP 800-88.

Full document on request

Request the documents

Tell us your company and which policies you need; sales replies within one business day.

Request security documents

Availability and payments

Plain terms on uptime and cards.

What the QBOID Cloud terms say, and how store payments work.

Availability

QBOID Cloud is run on a reasonable-effort basis, without a formal uptime SLA. Devices keep measuring and storing scans when the Cloud or the network is unavailable, and sync over Wi-Fi once the connection is back.

Cloud Basic keeps a rolling 30 days of history, so export the records you need to keep, or send them to your own systems.

Payments

Payments in the QBOID store ↗ are processed by Shopify. QBOID never stores payment card data, and the devices and QBOID Cloud don't collect it.

Report an issue · Legal documents

Found a vulnerability?

Email [email protected] with "Security Issue" in the subject, and include what you found and how to reproduce it. The address is also published in our security.txt.

Security review · Vendor assessment

Request security documents.

Tell us your company and which documents you need, and sales will reply within one business day.

  • Full policy documents for security reviews and vendor assessments
  • Sales replies within one business day
  • Or book a 20-minute remote demo on items you choose

Or write to [email protected], or call +1 (408) 419-1449.

Which documents do you need?

We use your details to reply to you; see the privacy policy.

Thanks.