QuantyDocs

Security & MFA

Quanty is built for teams that handle contracts, invoices and financial data, so security defaults are strict: signup is invite-only, two-factor authentication is mandatory, files carry per-person permissions, and anything shared publicly goes through revocable capability tokens.

Mandatory two-factor authentication

Every account must enroll a TOTP authenticator. "Your workspace requires a second factor at every sign-in."

  • Enrollment happens at first sign-in: scan the QR code (or enter the manual key) with Google Authenticator, 1Password, Authy or any TOTP app, then confirm with a 6-digit code.
  • Every session requires the 6-digit challenge after your password.
  • MFA cannot be turned off. Settings show the factor as Active or "Required — set up at next sign-in".
  • Lost your device? An administrator can use Reset MFA ("Reset two-factor authentication") so you can enroll again.

Enforcement is server-side: a session that has not completed the TOTP challenge cannot read or write anything in the workspace, so a half-authenticated session has no access to your data.

Invite-only signup

There is no open registration. An account is authorized by an organization invitation; signing in without one lands on "Your account isn't authorized yet". The allow-list check runs before MFA enrollment, so uninvited users never get far enough to enroll a factor.

Suspended accounts are blocked platform-wide the moment a support administrator suspends them, regardless of any valid session.

Admin console step-up

The platform support console is guarded independently of normal sign-in. Access requires explicit platform-level authorization, MFA, and a recent re-authentication. Every administrative action is written to an audit log.

File permissions

Files support per-item visibility, set from the share dialog in Files:

  • Everyone in the organization — the default.
  • Only me — private to the uploader.
  • Specific people — grant individual users or roles either Can view or Can manage.
  • Public share links for presentations and dashboards use unguessable 32-character capability tokens. They are read-only, revocable at any time, and their payload strips every internal identifier (no organization, workbook, sheet or user IDs). See Presentations & dashboards.
  • File downloads use short-lived signed URLs (HMAC-signed with an expiry), so a leaked link stops working on its own and the storage layer never trusts a bare path.

Write protection and confirmations

  • The Viewer role is read-only everywhere; every write endpoint and every writing chat tool rejects viewers.
  • Destructive chat tools (deleting rows, columns or pages, and bulk processing) require an explicit confirmation in the chat UI. The confirmation is backed by a single-use, HMAC-signed token bound to the exact conversation, tool and arguments, valid for 10 minutes. If the action's arguments change after approval, the token no longer matches and the tool refuses with "the action changed since it was approved".

Approval cannot be replayed

Each confirmation token is marked used on first execution. Replaying it fails with "this approval was already used", so one click can never authorize two actions.

Rate limiting

Everything you do in the app is rate limited per user, with tighter limits on AI actions. If you hit a limit, the app tells you how long to wait before trying again — limits protect the platform and your budget, and reset automatically.