Security and two-factor authentication

Quanty is built for teams that handle orders, invoices and contracts, so its defaults are strict: sign-up is by invitation only, every account uses two-factor authentication, files carry their own permissions, and anything shared outside the organization goes through links that can be revoked. This page covers what you set up yourself, what admins control, and where your data is processed.

Before you start

• Your own sign-in settings are under Settings, Account, Sign-in and security: "Your password and the second step that protects your account."
• Organization-wide switches (links for people outside the organization, roles) are for admins (see Organizations and roles).

Two-factor authentication

"Two-factor authentication is required for all members of this workspace and cannot be turned off." You choose how you confirm it is you, and you can set up both:

Set up an authenticator app

You set it up the first time you sign in, or later with Set up under Your methods:

1. Scan the QR code with your authenticator app (or Can't scan the code? and add the key by hand).
2. Enter the 6-digit code from the app.
3. Save your recovery codes (see below) and confirm "I've saved these codes".

After five wrong codes in a row the method locks for 30 seconds, then for longer each time, up to an hour: "Too many wrong codes. Locked for another 2 min."

Set up SMS codes

1. Under Code by SMS, click Set up.
2. Mobile number with its Country code: "Use the phone you carry. You will need it at every sign-in." Click Send the code.
3. Enter the 6-digit code from the text message and click Confirm this number: "SMS codes are on".

An SMS code is valid for 5 minutes and works once; three wrong tries cancel it. You can ask for a new one after 30 seconds (Send it again), and at most 10 codes are sent to you in 24 hours. The codes are sent from the name QUANTY, through AWS in Frankfurt; your mobile operator delivers them. Your number is used only for these codes.

Your methods

Your methods shows each method as On, Off or Locked. Remove switches a method off after you confirm with a code. Your only method cannot be removed: "This is your only method, so it cannot be removed. Set up the other one first."

Recovery codes

When you set up two-factor authentication you get 10 recovery codes, shown once: "This is the only time these codes are shown." Each signs you in once when neither method is to hand. The settings say how many are left ("8 recovery codes left"). Store them somewhere other than your phone.

Remembered browsers

At sign-in, Remember this device for 30 days: "You will not be asked for a code in this browser for 30 days. Leave this off on a shared computer." The 30 days count from that sign-in. Under Remembered browsers, Forget this browser or Forget all remembered browsers ask for a code again on the next sign-in.

If you lose your phone

Sign in with a recovery code, then set up a new method. If you have no recovery code left, or your codes ran out, write to Quanty support: only Quanty can reset your second factor or issue new recovery codes, after checking that it is really you. Your organization's admins cannot do it.

Sign-up and passwords

• Invite-only. "Quanty is invite-only. Sign up with the email address that received your invitation." Without an invitation: "Your account isn't authorized yet".
• Google. You can also sign in with Google, with the invited address.
• Passwords have at least 12 characters, with upper-case and lower-case letters and a digit. Change password "Requires your current password to change". A forgotten password is reset with a six-digit code sent by e-mail.
• Sign out on this device is under Settings, Account.

Who sees which files

Each file in Files has its own visibility, set in its share dialog:

"The uploader and organization admins always keep access." Files sent in a private conversation in Chat are confidential: "Only people in this conversation can see this file", with no exception for admins. See Sharing files.

Links for people outside the organization

• Files and folders. Share outside the organization makes a link that works for 1, 7, 30 or 90 days (7 by default), optionally with Require a password (8 to 128 characters) and Allow download. The link is shown once: "Copy it now. For your security it is shown only once: afterwards only its last characters are kept." Five wrong passwords lock it for 15 minutes. An admin can switch all such links off at once with Links for people outside the organization; files from a conversation are never shared by link. See Sharing files.
• Dashboards and presentations. A public link is read-only, can be revoked at any time, and its address cannot be guessed (see Dashboards and Presentations).
• Downloads. A file download or preview uses a signed address that stops working by itself after 10 to 60 minutes.

Where your data is processed

• The app and your data. Quanty runs on Amazon Web Services in Frankfurt (eu-central-1). Your projects, tables, files and accounts are stored there, and files are encrypted at rest. Messages in Chat are encrypted on the server with keys per organization (who can read which conversation is on Chat). Sign-in runs on Amazon Cognito, SMS codes go out through AWS End User Messaging, and e-mail through Amazon SES, in AWS Frankfurt.
• AI. The models behind columns, chat and agents are served on Amazon Bedrock under AWS's data processing terms, not by the model vendors directly. Depending on the model, a request is processed in AWS Regions in the EU or, for some models, in other AWS Regions. Speech-to-text runs on Amazon Transcribe.
• Web research. Columns and chat that read the internet send search queries, not your files, to Quanty's web search provider.
• Payments. Card details are entered on Stripe's own checkout page; a card number never reaches Quanty.
• Phone calls and WhatsApp. Only if you use the AI Secretary or WhatsApp; each page says where that data goes.

The companies that process data for Quanty are listed at quanty.ai/subprocessors.

Approvals in chat

• A Viewer cannot change anything, in the app or through the chat.
• Before the chat deletes rows, columns or pages, or processes many rows at once, it asks you to approve the exact action. The approval is valid for 10 minutes and once: if the action changes after you approved it, the chat refuses ("the action changed since it was approved"), and the same approval cannot be used twice ("this approval was already used").

Limits

Quanty limits how many requests each person sends, with tighter limits on AI actions. If you hit one: "You're sending requests too quickly. Please wait a moment and try again." Limits reset by themselves.

Good to know

• A suspended account is blocked at once, whatever sessions it has open: "Account is suspended. Contact support."
• Deleting your account is under Settings, Account: you confirm with your e-mail address, and the subscription of an organization only you use ends at once. Your account is archived for about six months, then erased with your private files and any organization nobody else is in; files and data in organizations you share with others stay there and pass to an admin. While you are the billing contact of an organization other people use, deletion is refused: "Move the billing contact first".
• Quanty support access. When Quanty helps set up your organization, the support person is listed under Support access on the Members tab, with the reason and the end date (at most 30 days), and admins can revoke it at once (see Members and invitations).
• Team activity. Admins see when and how long members are active in the app (see Organizations and roles).

Related pages

• Organizations and roles: who can do what.
• Members and invitations: inviting people.
• Sharing files: file permissions and outside links.
• Getting started: signing in for the first time.