Trust is not promised, it is proven. Qubria requires two-step verification (TOTP) on every account, with AAL2 assurance and hardened blocking for privileged roles. Passwords are checked against known breach databases using k-anonymity and expire according to policy.
Every relevant action — sign-ins, role changes, exports — is written to an audit log that is time-stamped and chained by hash: its integrity is verifiable and cannot be altered without leaving a trace. Sensitive data is pseudonymized before it is recorded.
Two-factor for everyone, an audit trail that cannot be altered and every record isolated by organization: security is the foundation, not an add-on.
Isolation is structural. Row-level security (RLS) guarantees that each organization only sees its own data, and role-based access control reaches down to the department and entity level, with separation of duties for critical actions.
Underneath it all, Qubria runs on managed infrastructure on AWS and backed by Supabase, with SOC 2 Type 2 and ISO 27001 certifications and automatic backups. The architecture is aligned with the Spanish National Security Framework (ENS) and the GDPR.
