In short
Qaid stores your ledger in a Supabase-hosted Postgres database and your documents in a private storage bucket; every request is checked against your company membership; AI drafts are approved by you before posting; traffic is encrypted with TLS and HTTPS is enforced; transaction text and documents are processed by Anthropic's Claude API; and you can request export or deletion of your data. Qaid does not currently hold SOC 2, ISO 27001 or similar certifications.
Controls in the product
| Control | What it means | Status |
|---|---|---|
| Human approval of AI drafts | Entries proposed by the AI are posted only when you approve them. An optional Autopilot mode can be enabled per company; the change is logged. | Live |
| Tenant isolation | Every API request resolves your user and your active company and is rejected unless you are a member of that company. Data from one company is never returned to another. | Live |
| Role definitions | Roles (owner, admin, accountant, viewer) with capability checks are defined and enforced in code; today each company has a single owner because invitations have not shipped. | Partial |
| Audit log | Approvals, corrections, voids, settings changes (including Autopilot) are written to an append-only audit log with the acting user. | Live |
| Private file storage | Receipts, invoices and statements are stored in a private bucket and served only through an authenticated, company-scoped route — never from a public URL. | Live |
| Rate limiting | Sensitive routes (authentication, uploads, AI calls) are rate-limited per user/IP. | Live |
| Public invoice links | Share links use unguessable tokens and can be revoked; the invoice host is excluded from search engines via robots.txt. | Live |
| Authentication | Email and password via Supabase Auth; session tokens are stored in httpOnly, secure cookies; password reset by emailed link with a recovery time window for password changes. | Live |
| Two-factor authentication | Not yet available. | Planned |
| Team invitations & approval workflows | Not yet available. | Planned |
Infrastructure and encryption
- **In transit:** all connections to myqaid.com and dashboard.myqaid.com use TLS; HTTPS is enforced with HTTP Strict Transport Security (HSTS).
- **At rest:** the database and file storage are hosted by Supabase, whose platform encrypts customer data at rest. Source: Supabase security.
- **Application hosting:** the web app runs on Vercel. Source: Vercel security.
- **Backups:** provided at the Supabase platform level per the project's plan; Qaid does not currently offer customer-initiated restore points.
AI processing
To draft an entry, extract a document or answer a question, Qaid sends the relevant text, file contents and the minimum ledger context to Anthropic's Claude API. Under Anthropic's commercial terms, API inputs and outputs are not used to train Anthropic's generative models. Source: Anthropic commercial terms. Your ledger itself is never stored by the model provider; results come back as drafts for your review.
Sub-processors
| Provider | Purpose | Privacy policy |
|---|---|---|
| Vercel | Application hosting, edge network, web analytics (aggregate, cookieless) | vercel.com |
| Supabase | Postgres database, authentication, private file storage | supabase.com |
| Anthropic | AI model (Claude) for interpreting transactions and documents | anthropic.com |
| Resend | Transactional email and the inbound receipt inbox | resend.com |
Your data, your choices
- **Export:** request a full export of your company's transactions, documents and reports by emailing hello@myqaid.com from your account address. Reports can be exported as PDF from the app at any time.
- **Deletion:** request deletion of a company or your account by email; we remove the ledger, documents and inbox address. Self-serve export and deletion are planned.
- **Archiving:** companies can be archived and restored from settings.
AI limitations you should know
- The AI can misread a receipt or choose a wrong account. That is why drafts are reviewed and why each draft shows its reasoning.
- Insights and tax figures (VAT, Zakat estimate, income-tax provision) are calculations from your records, not advice, and not filings.
- Qaid cannot see transactions you never record; reports are only as complete as your books.
What we do not claim
Qaid does not currently hold SOC 2, ISO 27001, PCI DSS or similar certifications, has not been audited by a third party, and is not approved by any tax authority. We will update this page when that changes.
Reporting a vulnerability
If you believe you have found a security issue, email hello@myqaid.com with details. Please give us reasonable time to respond before public disclosure.
Last reviewed: