Privacy, Incidents and Patching
Roles under KVKK and GDPR
- On-premise installation: you are the data controller and Quixa is not a processor; no data reaches Quixa. Support access happens only through sessions you open.
- Quixa Cloud: you are the controller, Quixa is the processor under the data processing agreement.
Personal data Quixa processes
Use masked or synthetic test data where possible (QMock generates realistic synthetic data). Credentials in stored execution history are redacted automatically.
Deletion
- Execution history and audit events are deleted automatically after the retention period (hardening guide).
- Deleting a user removes the account and ends all sessions.
- Deleting a workspace (Backoffice, platform administrator) removes all of its data: flows, collections, credentials, executions, users and settings. The deletion itself is recorded in the platform audit log.
- Backups follow your backup retention; delete old backup files to complete an erasure request.
Subprocessors (Quixa Cloud)
On-premise installations use none of these unless you configure them.
Incident response
Report a suspected vulnerability or incident to the security contact named in your contract. Quixa acknowledges within one business day, investigates, and informs affected customers without undue delay, so that you can meet the 72-hour notification duty of KVKK / GDPR. Customers receive a written report with cause, impact and remediation.Security patch timelines
Patched releases ship as a new air-gap bundle with SBOM and scan results; upgrades keep your data and secrets.
The contact, acknowledgement time and patch timelines above are Quixa’s standard terms; your contract may define different values, which then apply.