Trust and security

The database, uploaded and generated files, sign-in accounts, backups and logs are stored in the Frankfurt region of Amazon Web Services (eu-central-1). The site is delivered through Amazon CloudFront’s global network. Only the public, content-hashed app files (/assets) are cached at the edge; pages, API responses and personal data never are, so CloudFront does not keep copies of your data.

• In transit: HTTPS only, with HSTS. The application talks to the database over TLS, and file storage refuses unencrypted connections.
• At rest: the database storage is encrypted (in production with our own AWS KMS key, rotated automatically every year). Uploaded and generated files and the DynamoDB tables are encrypted by AWS.

The tables that hold your portfolio (the business profile, properties, reservation imports, stays, computations, filings and subscriptions) are protected by PostgreSQL row-level security in FORCE mode, keyed on the entity (the business) a request is made for. The application connects with a database role that cannot bypass those rules and owns no tables, so a query without the right entity sees nothing.

An automated test proves it on every code change, on each pull request and each push to the main branch: acting as the application role against a real PostgreSQL database, one entity must see none of another entity’s rows. Every deployment also checks, against the real database, that the rules bind the application role, and stops if they do not.

The production database keeps point-in-time backups for 14 days and has deletion protection turned on.

Quadrarium is run by its founder, who is the only person with access to the production systems, and only for support and operations.

Inside the product, access is per entity: its owner can give an accountant or a teammate access by email.

If a personal-data breach affects data we process for you, we will tell you without undue delay after becoming aware of it, as Article 33(2) GDPR requires, with what we know and what we are doing about it. Where we are the controller, we notify the supervisory authority when the GDPR requires it.

• Official source: every rate, exemption, cap and deadline comes from an official source, usually the comune’s regulation, which is recorded with the rule.
• Human check: a person checks the rule against that source and records the date. Until then the engine does not use it: the stay is shown as needing review instead of getting a figure.
• Dated versions: each rule carries the dates it applies to, so a stay is taxed under the rule in force on its date, and a past figure can still be reproduced after the rule changes. Each computation records the rule it used.
• Cited output: the audit pack cites the source of every figure.

Every euro figure comes from a deterministic calculation: the same stay under the same rule always gives the same result. An optional AI feature can explain a reconciliation in plain language; it receives only totals and counts, runs on Amazon Bedrock in the EU, and cannot change a figure.

We also use AI internally to draft rule candidates from official texts. A draft stays invisible to the engine until a person has checked it against the source.

Quadrarium does not submit declarations or payments for anyone: you or your intermediary do. Until a declaration format has passed the official control module, every file in that format is marked as test output and must not be submitted.

Write to [email protected]. Our security contact is also published at /.well-known/security.txt.