Security & sub-processors
Last updated · Sub-processor list version 2
Quorum is a hosted service: we run the application, its database and its background processing, and it reads only what the connections you create allow. This page lists every third party that can receive data, and the controls that are actually implemented in the service.
Quorum is operated by Creative Coders sp. z o.o., ul. Płk. Zoltána Baló 6 lok. 5, 02-793 Warszawa, Poland. The registry details are on the Company information page.
Sub-processors
Render hosts Quorum itself and Resend delivers its email. Every other entry is conditional: Quorum contacts a provider only when you have connected it, or, for error monitoring and the backup restore test, only once the operator has switched it on. A workspace that connects only Microsoft never sends a byte to Google, Zoom, Slack, or any model vendor. Legal entities are as named in each provider’s public terms.
| Sub-processor | Purpose | Data it receives | When | Where, and transfer basis |
|---|---|---|---|---|
| RenderRender Services, Inc. (United States)Listed since | Hosts the Quorum application, its background processing and its PostgreSQL database | Everything Quorum stores for your workspace, encrypted in transit; provider credentials are additionally encrypted by Quorum before they reach the database | Always — this is where Quorum runs | EU — Render’s Frankfurt, Germany region holds the application, background processing, the database and its backups. Render Services, Inc. is a US company: its staff access for support and operations relies on the EU Standard Contractual Clauses in Render’s DPA |
| Merge or Kombo, and your connected HRISMerge API, Inc. (United States); Kombo Technologies GmbH (Germany)Listed since | Synchronizes the company directory and organization groups through a read-only connection | Work email, name, job title, employment status and dates, reporting manager references, group memberships; company name and connecting administrator email identify the customer connection. Quorum does not store payroll, private contact details, bank data or raw HRIS responses | Only after an administrator connects an HRIS through the provider shown on the connection screen. Provider availability, geographic processing and contract terms must be verified for that connection | Kombo: EU (Germany). Merge: Quorum uses Merge’s EU region; Merge, Inc. is a US company, so access from the US relies on the EU Standard Contractual Clauses in Merge’s DPA. Your HRIS: wherever your contract with it says |
| Microsoft (Graph API)Microsoft Ireland Operations Ltd for EEA customers; Microsoft Corporation (United States)Listed since | Reads Outlook calendars and Teams attendance for the tenant you connect | Meeting metadata, invitee lists, join/leave records | Only if you connect Microsoft | Your Microsoft 365 tenant’s region; for EEA customers Microsoft Ireland Operations Ltd within the EU Data Boundary. Transfers rely on the EU Standard Contractual Clauses in Microsoft’s DPA |
| Google (Calendar and Meet APIs)Google Ireland Ltd for EEA customers; Google LLC (United States)Listed since | Reads Google Calendar invites and Meet attendance via a service account you create | Meeting metadata, invitee lists, join/leave records | Only if you connect Google | Google Workspace data location under your own Google agreement; Google Ireland Ltd for EEA customers. Transfers rely on the EU Standard Contractual Clauses in Google’s data processing terms |
| ZoomZoom Communications, Inc. (United States)Listed since | Reads attendance for meetings hosted on Zoom | Participant join/leave records | Only if you connect Zoom | United States and Zoom’s regional data centres, under your Zoom account settings. Transfers rely on the EU Standard Contractual Clauses in Zoom’s DPA |
| SlackSlack Technologies, LLC, a Salesforce company (United States); Slack Technologies Limited (Ireland) for EEA customersListed since | Delivers verdict DMs, pulse surveys, the weekly digest and meeting-change guides to the person assigned; carries /quorum ask questions and their private answers | The Slack member directory (ids and work emails) is read to match accounts and only matches are kept; message content Quorum sends, assistant questions and answers in transit | Only if you install the Slack app | United States unless your Slack plan uses data residency. Transfers rely on the EU Standard Contractual Clauses in Slack’s DPA |
| Microsoft (Teams and Azure Bot Service)Microsoft Ireland Operations Ltd for EEA customers; Microsoft Corporation (United States)Listed since | Carries questions to the Quorum assistant in a 1:1 Teams chat and its answers back, and delivers meeting-change guides to the person assigned. With channel tracking on, receives the channel messages of teams the Quorum app is added to, through the ChannelMessage.Read.Group resource-specific permission, to count thread volume and time to first response | The question, the asker's Teams identity (to match their Quorum account) and the answer — team-, series- and workspace-level figures only. A guide names the meeting, the change and the calendar steps. Channel messages arrive with their text, which is discarded on arrival and never stored, logged or sent to AI; Quorum keeps message and thread ids as opaque receipts, times, mapped participants (matched by work email from the Teams roster), channel and team names, and a keyed digest of a thread's author only until someone else answers | Only if your administrator registers your Microsoft app as an Azure Bot and uploads the Quorum Teams app; channel messages only after a separate administrator opt-in in Setup and a team owner's consent per team | Teams data in your tenant’s region; Azure Bot Service relays messages through Microsoft’s global infrastructure. Transfers rely on the EU Standard Contractual Clauses in Microsoft’s DPA |
| Google (Chat API)Google Ireland Ltd for EEA customers; Google LLC (United States)Listed since | Carries questions to the Quorum assistant in a Google Chat direct message and its answers back, and delivers meeting-change guides to the person assigned | The question, the asker's Google Workspace email (to match their Quorum account) and the answer — team-, series- and workspace-level figures only. A guide names the meeting, the change and the calendar steps | Only if Quorum has enabled the Google Chat app for your workspace and your Workspace administrator allows it | Google Workspace data location under your own Google agreement. Transfers rely on the EU Standard Contractual Clauses in Google’s data processing terms |
| Google (Gemini API) and/or OpenAIGoogle LLC (Gemini API); OpenAI, L.L.C. or OpenAI Ireland Ltd for EEA customers (United States / Ireland)Listed since | Classifies who needs to attend a meeting live, drafts series recommendations, and answers admins' and managers' questions in the workspace assistant | Meeting title, agenda, invitee roles — never sensitive-meeting content, never names of people being evaluated. For the assistant: the question asked and a sheet of team-, series- and workspace-level figures the reader can already open; nothing per person, and neither the question nor the answer is stored | Only when AI analysis is enabled for your workspace. Without it, series recommendations and the weekly audit fall back to deterministic rules and nothing is sent to any model — the per-invitee live/async classification does not run at all, because there is no rule that decides who has to be in a room | Outside the EEA: model requests are processed in the United States. Transfers rely on the EU Standard Contractual Clauses in Google’s and OpenAI’s API data processing terms. Without AI analysis nothing is sent |
| GitHub (signed webhooks and count-only API queries)GitHub, Inc., a Microsoft company (United States)Listed since | Counts comments on pull requests and issues so a thread that has outgrown async can be spotted | Webhook payloads arrive from GitHub. Quorum uses participant logins, titles, timestamps and state, then requests current comment totals through GraphQL. API queries exclude comment bodies and code; comment text is not stored or sent to AI | Only if you configure a repository connection and add its webhook | United States (GitHub, Inc., a Microsoft company). Transfers rely on the EU Standard Contractual Clauses in GitHub’s DPA |
| Atlassian (Jira Cloud signed webhooks)Atlassian Pty Ltd (Australia) or Atlassian US, Inc., as your own Atlassian agreement namesListed since | Counts comments on Jira issues and times the first response, per project | Webhook payloads arrive from your Jira site, signed with a secret you set. Quorum uses the issue key and summary, ids, dates, state, and account ids or in-domain email addresses to map participants; descriptions and comment bodies arrive in the payload and are discarded on arrival — never stored, logged or sent to AI. Quorum makes no request to Atlassian | Only if you add a Jira site in Setup and register its webhook | Your Jira site’s own region. Quorum sends nothing to Atlassian; your site sends events to Quorum in the EU |
| Linear (signed webhooks)Linear Orbit, Inc. (United States)Listed since | Counts comments on Linear issues and times the first response, per team | Webhook payloads arrive from Linear, signed and timestamped. Quorum uses the issue identifier and title, ids, dates, state, and user ids or in-domain email addresses to map participants; descriptions and comment bodies are discarded on arrival — never stored, logged or sent to AI. Quorum makes no request to Linear | Only if you add a Linear workspace in Setup and create its webhook | Your Linear workspace’s own region. Quorum sends nothing to Linear; Linear sends events to Quorum in the EU |
| GitLab (GitLab.com or your self-managed instance; webhooks)GitLab Inc. (United States) for GitLab.com; your own organisation for a self-managed instanceListed since | Counts notes on issues and merge requests and times the first response or approval, per project | Webhook payloads arrive from GitLab with the secret token you set. Quorum uses the issue or merge request number and title, ids, dates, state, and usernames or public in-domain email addresses to map participants; note and description text is discarded on arrival — never stored, logged or sent to AI. Confidential issues are ignored. Quorum makes no request to GitLab | Only if you add a GitLab project or group in Setup and add its webhook | GitLab.com or your own instance. Quorum sends nothing to GitLab; GitLab sends events to Quorum in the EU |
| ResendResend, Inc. (United States)Listed since | Delivers sign-in links, verification emails, meeting-change guides, an organizer's attendance suggestions, and conversation decisions to a team's manager or the workspace administrators | Recipient email address and the message: a link, or for a guide the meeting, the change and the calendar steps. An organizer's email names the meeting, its time, invitee count and planned cost, and each suggested invitee with the suggestion and its short reason. A conversation email holds its title, source, message and participant counts and two cost estimates — never message text or per-person counts | Whenever Quorum sends a sign-in link, a verification email, or a guide to the person assigned a meeting change; once per meeting when its suggestions are ready; once per recipient when a conversation has outgrown async | Resend, Inc. is a US company; messages are delivered from the sending region configured for Quorum’s domain. Transfers rely on the EU Standard Contractual Clauses in Resend’s DPA |
| Sentry (error monitoring)Functional Software, Inc., doing business as Sentry (San Francisco, United States)On the list from | Application error monitoring: groups failures in the Quorum application, its background processing and its pages in the browser, and alerts Quorum's engineers so they can be fixed | A redacted error type and message, code locations, the route pattern, opaque job and workspace ids, the release and the browser class. No names, email addresses, IP addresses, cookies, request bodies, or meeting, calendar or message content; no Sentry software runs inside Quorum or in your browser | Only while the operator sets SENTRY_DSN in production. Not active unless configured, and never before the date this entry takes effect | EU — Sentry’s EU region in Frankfurt, Germany (de.sentry.io); events are stored in the EU. Remote access by the US parent relies on the EU Standard Contractual Clauses (Module 3) in Sentry’s DPA |
| GitHub (restore test runners)GitHub, Inc., a Microsoft company (United States)On the list from | Automated verification that the database backups can be restored | A temporary full copy of the database, restored on the runner and deleted when the job ends; nothing is kept | Only if the operator enables the restore test on GitHub-hosted runners. Not active unless enabled, and never before the date this entry takes effect | A GitHub-hosted runner, whose region is not guaranteed and may be outside the EU. Transfers rely on the EU Standard Contractual Clauses in GitHub’s DPA |
Changes to this list
At least 30 days before a new sub-processor starts processing customer personal data, or an existing one changes what it receives or where, we update this page and email every workspace’s administrators, and the privacy contact an administrator can set in Settings. Until the change takes effect an administrator can object to it in Settings → Sub-processors; we record the objection and respond. What follows an objection is set out in your agreement with us and its data processing agreement. A sub-processor we stop using may be removed at once. A replacement takes effect sooner only in an emergency — a provider that stops its service or breaches its terms — and the change then says why.
| Version | Change | Announced | Takes effect |
|---|---|---|---|
| Version 2 | Added: Sentry (Functional Software, Inc.). Added Sentry for application error monitoring of the Quorum application, its background processing and its browser pages, only while the operator configures it, in Sentry's EU region (Frankfurt). It receives a redacted error type and message, code locations, the route pattern, opaque job and workspace ids, the release and the browser class — never names, email addresses, IP addresses, cookies, request bodies, or meeting, calendar or message content. | ||
| Version 2 | Added: GitHub (restore test runners). Added GitHub-hosted runners for an automated test that the database backups can be restored, only if the operator enables it. A temporary full copy of the database is restored on the runner and deleted when the job ends; the runner's region is not guaranteed and may be outside the EU. | ||
| Version 1 | First dated version of this list. Entries listed before then carry this date. |
Implemented controls
- Provider credentials are encrypted at rest with AES-256-GCM before they touch the database. Plaintext tokens are never stored and never logged. The encryption key is held in the hosting platform’s secret configuration, separately from the database.
- Tenant isolation is enforced on every query. Every read is scoped to the signed-in admin’s workspace, and a change that reads without that scoping is not released.
- Sign-in links are hashed (SHA-256), single-use, and expire in 15 minutes. Passwords, when set, are stored with scrypt and only become usable after email verification.
- Company SSO (OIDC) is in beta. Signatures, issuer, audience, expiration, nonce and browser-bound PKCE are checked. It has not yet been validated with every identity provider, so test it with a non-production identity provider first. Choosing SSO routes sign-in to the configured identity provider. Deactivate the person in Quorum to revoke local sessions and access. IdP offboarding alone does not revoke existing local sessions or disable other sign-in methods.
- Every Slack request is signature-verified, and every interaction is scoped to the acting Slack user’s own employee record and workspace.
- Admin actions are recorded in an audit trail — who changed a policy, a cost band, a person’s access, or ran a job, and when. Visible to you in Settings.
- State-changing requests must come from this origin. The session cookie is SameSite=Lax and every mutating request is refused if the browser reports a different origin — including the sign-in routes, which create a session rather than requiring one and so are not protected by the cookie policy alone. Webhooks are exempt and authenticated by signature instead.
- Outbound URLs a workspace supplies are validated. An OIDC issuer or webhook URL must be https, must not embed credentials, and must not resolve to a private, loopback, or link-local address — including the cloud metadata endpoint. The discovery document is checked the same way, since it names three further endpoints.
- Retention is enforced by a daily job that deletes data past your configured windows. See the Privacy notice.
- Privacy floors are published. The smallest group each figure may describe, read from the values the product enforces, is on the Works council & DPIA pack page, with FAQs for a works council and for employees and a DPIA outline.
Compliance status
Quorum does not currently hold a SOC 2 or ISO 27001 certification.
We would rather tell you that than imply otherwise on a page your security team is reading. What is available today is this document, the control list above, and the product behaviour it describes, which your team can check for itself during an evaluation.
If your procurement process requires an attested report, a completed security questionnaire, a signed DPA, or a penetration-test summary, raise it during evaluation so expectations are set before a contract rather than after.
Data residency
Quorum runs in the European Union: its application, background processing and its single PostgreSQL database, with that database’s backups, are hosted by Render in its Frankfurt, Germany region. Render Services, Inc. is a US company, so its support and operations access is covered by the transfer terms in the table above. Every other provider processes data in the places listed for it, and only once you connect it. Database backups allow point-in-time recovery for 3 days; a deleted workspace or person leaves them within that window (see the Privacy notice).
International access to data. Quorum’s application, database and backups are hosted by Render in its Frankfurt, Germany region, so the infrastructure is subject to EU and German law. Render Services, Inc. is a US company and may itself be subject to US law, including orders under the US CLOUD Act. To protect the data we hold, personal and non-personal, against access by authorities outside the EU that would conflict with EU or Member State law:
- we store it only in the EU region;
- it is encrypted in transit, and Quorum additionally encrypts provider credentials with AES-256-GCM under a key kept apart from the database;
- Quorum staff access is limited to what running the service requires.
We disclose customer data to an authority only where an order binds us under EU or Member State law or an international agreement recognised under it. We review every request, challenge any we consider unlawful, disclose the minimum required, and tell the customer first unless the law forbids it. Render’s own commitments are in its data processing agreement.
Reporting a vulnerability
Our Vulnerability disclosure policy sets out what is in scope, how to report a suspected vulnerability, the rules for testing, our safe-harbour commitment and our response times. Contact details are also published at /.well-known/security.txt.