Security
Built by a security practice, for firms whose clients ask hard questions
Your proposals hold your clients' scope and your commercials; your books hold your firm. These are the controls that protect them.
Tenant isolation in the database
Every business table carries the organisation it belongs to, and Postgres row-level security enforces the boundary. A missed filter in code cannot leak one firm's data to another.
Strong sign-in for everyone
Verified sign-up and invited team members, Argon2id password hashing, mandatory authenticator codes and passkeys. Platform administrators confirm risky actions with a fresh password and code, and the riskiest need a second person.
Qryti staff manage your account, not your records
We can see inside only if your admin approves: look-only and time-limited. You can switch that off. Every page we open is in your audit log. While your organisation is active, only your admin can download your data.
A full audit trail
Who changed what, when and from where, for every record. Signed-in sessions can be reviewed and ended at any time.
Documents that cannot change
Issued proposals and invoices are kept as snapshots the database refuses to change, with a hash recorded at acceptance.
Hosted in India
Qryti runs in an Indian cloud region, served over TLS only. Data is encrypted in transit and at rest, and secrets never live in code.
Backups we restore
Automated backups with a restore drill we actually run, because untested backups are not backups.
Least privilege by design
Permission-based access with six built-in roles, section-level rights on proposals and custom roles on higher plans. Business Heads see their own and their team's work; Analysts their own.
Money needs the right person
Expenses, bank entries, salaries, claims and partner payouts are approved by the Tenant Admin or Finance, by role, never by a custom role, and Finance never approves its own entry.
Suggestions wait for people
Anything Qryti suggests, such as a bank match, stays Unapproved until a person approves it.
Secure development
Security scanning gates every change, and an external penetration test runs before every major release.
Reporting a vulnerability
Email connect@qryti.com with what you found, how to reproduce it and the impact you believe it has. We acknowledge reports within 2 working days, fix critical issues within 7 days and credit researchers unless they ask us not to. Research that stays within your own workspace and avoids harm to others is welcome.
Have a security questionnaire?
Book a call and we will walk your team through our architecture and controls.