Isolation and privacy
Content owner: Quote Control product. Last reviewed: 20 September 2026.
Each pilot company runs in a separate Quote Control deployment with its own PostgreSQL database and private object store. Companies do not share a tenant table, bucket or sign-in workspace.
Server authority
Section titled “Server authority”The server checks account state, role, quotation ownership, company visibility and module availability on every protected route. Client navigation reflects those rules but is not the security boundary.
Independent approval remains separate from quotation ownership. A company setting cannot let an estimator approve their own higher-value work or bypass required preparation checks.
Private files and historical records
Section titled “Private files and historical records”Quotation documents and evidence stay in private object storage. The application authorises access before returning a file. Issued PDFs are retained with their revision, so later identity or policy changes do not rewrite the customer record.
Submitted revisions keep their commercial control and company-preference versions. Material actions produce audit events. Company administrators can review and export audit data or request a company export through controlled application actions.
Account names remain administrator-assigned during the pilot. Ask an administrator to correct your account details. See access and account setup for password replacement and recovery.
The public role and visibility matrix explains the separate ownership, approval, handover and private-feedback limits.
Pilot recovery
Section titled “Pilot recovery”Export company data is a user-controlled portability snapshot. It has no supported application import and is not a database or private-object restore. Service recovery is an operator-controlled Railway procedure, separate from the company ZIP.
Before a new pilot company enters records or files, the operator verifies scheduled PostgreSQL backups, a separate private copy of application files and a restore with synthetic data. Live and recovery resources remain within Railway. The pilot does not claim protection from a Railway-wide failure or loss of the Railway workspace owner account.
Product feedback is stored separately from company quotations and files. The collector database is backed up within Railway, but complete disaster recovery for optional feedback screenshots is not part of the current pilot gate. Do not attach customer information, prices, credentials or other sensitive material to product feedback.
AI-assisted scope
Section titled “AI-assisted scope”AI suggestions are optional, server-mediated and use the company’s configured OpenAI project. The result is an editorial draft that requires review. Quote Control does not treat it as technical approval or a compliance decision.
The integration credential is write-only in the application and encrypted at rest. Public pages and read APIs never return it.
Engineer reports and private accuracy evidence
Section titled “Engineer reports and private accuracy evidence”Where the report pilot is enabled, uploading saves a private PDF. Only explicit analysis sends it to the company’s configured AI service. Unfinished imports expire 30 days after the last successful upload, analysis or review save. Converted sources follow quotation-document retention.
Private accuracy evidence retains the original proposal, its latest saved or captured review and optional feedback for up to 90 days from analysis start. Reads and ratings do not extend this deadline. Earlier import removal or quotation deletion removes private evidence sooner; later quotation edits do not rewrite the captured snapshot.
Before conversion, access belongs to the report owner and company administrators. Afterwards, it follows the current quotation owner and administrators. Administrators can inspect and explicitly export eligible evidence.
Explicitly saved company part mappings contain public product facts and remain company reference records after the source report or quotation is deleted. Deactivation prevents reuse without erasing the mapping or previously accepted quotation evidence.
Where optional parts research is enabled, pending research payloads and private source details remain available only to the quotation owner and company administrators. A human can accept a bounded record of public product facts, public web references and checks. That accepted evidence follows the quotation’s normal authorised access and is included in later internal snapshots. Copying a quotation retains a separate unverified copy for fresh review; it does not copy private research payloads. Deleting the source report removes private research content while retained accepted evidence follows the quotation. Customer PDFs do not include research evidence.
This is separate from product feedback. AI evidence is not automatically shared across companies or used to train a model. Physical cleanup follows logical expiry; backups have separate retention. Read the report guide for the workflow.
Product feedback
Section titled “Product feedback”Quick feedback and Project research leave the company deployment through an authenticated, write-only server connection to a separate operator-owned collector. The collector derives the company from an instance credential and records the signed-in author and deployed release from server-owned metadata.
The company database retains only a content-free delivery receipt and audit event. It does not retain the feedback body or screenshot, and the company workspace has no read access to the central collector. Each user can see their own local Project-research draft and submitted summary; administrators cannot browse another user’s product feedback. Company exports also exclude Project research and product feedback.
Optional screenshots must be reviewed PNG or JPEG files no larger than 5 MB. They are processed, stored privately by the collector and retained for up to 90 days. Review the screenshot before submission and wait before retrying if a submission limit is reported.
What this page does not claim
Section titled “What this page does not claim”Quote Control does not claim a certification, guaranteed uptime, regulatory compliance, SSO or a shared multi-tenant platform. Pilot companies should assess the workflow and data-processing position against their own obligations.