Trust · security, data & procurement
Built for the auditor’s questions, too.
Hosted in AWS London (eu-west-2) · 30-day trial to evaluate it yourself
Security and hosting
The controls the platform runs today.
Hosting
AWS London (eu-west-2)
Database
PostgreSQL 15 on Amazon RDS, encrypted at rest
Isolation
Row-level security
Audit
Append-only audit log
Sign-in
MFA and single sign-on
Uploads
Infected files blocked
More detail on the security page.
The procurement pack
What your DPO, finance officer and IT lead will ask for.
Data Processing Agreement
UK GDPR Article 28 terms: processing, security measures, sub-processors, breach notification.
Read →Sub-processor list
Every sub-processor, the data it handles and where.
Read →Privacy policy
How we handle personal data as a controller.
Read →Accessibility statement
Our WCAG 2.2 AA target, current status and the known gaps.
Read →Terms of service
The contract for using Quorate.
Read →Security overview
The technical controls, in more detail.
Read →Service status
Current incidents.
Read →Need a security questionnaire answered or a DPIA input? Contact us and we will answer it from the same facts.
Our commitments
The numbers procurement teams ask for, and where each comes from.
Breaches
Within 72 hours
Sub-processors
30 days’ notice
Leaving
90 days, then deleted
Prices
30 days’ notice
Your data, your control
Your data, exportable
Meetings, decisions, actions and members export to CSV; the audit log exports; packs and documents download as files; every user can download their own personal data.
Subject access and erasure
Built-in tools for subject access requests, with due-date reminders, and an erasure workflow.
No AI processing
Quorate does not send your content to any AI model provider, and no AI provider is a sub-processor.
Part 2 stays private
Confidential items and documents are excluded from public packs and the public portal; access is permission-controlled and audit-logged.
Certifications and audits
What has and has not been completed.
None completed yet. A security questionnaire is available on request: send us yours and we will answer it line by line.
- Production runs a single database instance with encrypted backups kept for 35 days; recovery is from backups.
- We do not offer an uptime SLA.
Who provides Quorate
Quorate is provided by Zero Drift Ltd, company number 17202217, registered office The Glass House, Rhododendron Avenue, Meopham, Gravesend, England, DA13 0TT.
Accessibility
We aim to meet WCAG 2.2 AA and currently describe the platform as partially compliant, listing the known gaps in our accessibility statement. Public-sector customers subject to the 2018 accessibility regulations can use it when preparing their own statements.
Organisation branding colours are checked for contrast before they are saved, so a public portal cannot be themed into failing text contrast. Read the accessibility statement.
Questions from your buying team
Send us your questionnaire.
We will answer it from the same facts on this page.