> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quixa.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy, Incidents and Patching

> KVKK / GDPR roles, personal data processed, retention and deletion, subprocessors, incident response and security patch timelines.

# Privacy, Incidents and Patching

## Roles under KVKK and GDPR

* **On-premise installation**: you are the data controller and Quixa is not a processor; no data reaches Quixa. Support access happens only through sessions you open.
* **Quixa Cloud**: you are the controller, Quixa is the processor under the data processing agreement.

## Personal data Quixa processes

| Data | Purpose | Retention |
| :- | :- | :- |
| User accounts (name, e-mail, role, sign-in times) | Access control | Until the account is deleted |
| Session and audit data (IP address, user agent, actions) | Security, accountability | Sessions: 12 hours; audit events: 365 days by default (minimum 90) |
| Test data in flows and execution results | Testing your APIs | Executions: 90 days by default; flows until deleted |

Use masked or synthetic test data where possible (QMock generates realistic synthetic data). Credentials in stored execution history are redacted automatically.

## Deletion

* Execution history and audit events are deleted automatically after the retention period ([hardening guide](https://docs.quixa.io/security/hardening-guide.md#9-retention)).
* Deleting a user removes the account and ends all sessions.
* Deleting a workspace (Backoffice, platform administrator) removes **all** of its data: flows, collections, credentials, executions, users and settings. The deletion itself is recorded in the platform audit log.
* Backups follow your backup retention; delete old backup files to complete an erasure request.

## Subprocessors (Quixa Cloud)

| Subprocessor | Purpose | Location | When |
| :- | :- | :- | :- |
| Microsoft Azure | Hosting, database, e-mail (Azure Communication Services) | EU | Always |
| AI provider chosen by you (Anthropic, OpenAI, Google) | AI features | Provider region | Only when AI is on |
| GitHub | In-app feedback reports | US | Only when a user sends feedback |

On-premise installations use none of these unless you configure them.

## Incident response

Report a suspected vulnerability or incident to the security contact named in your contract. Quixa acknowledges within one business day, investigates, and informs affected customers without undue delay, so that you can meet the 72-hour notification duty of KVKK / GDPR. Customers receive a written report with cause, impact and remediation.

## Security patch timelines

| Severity (CVSS) | Fix available to customers |
| :- | :- |
| Critical (9.0–10.0) | 7 days |
| High (7.0–8.9) | 30 days |
| Medium (4.0–6.9) | 90 days |
| Low | Next regular release |

Patched releases ship as a new air-gap bundle with SBOM and scan results; upgrades keep your data and secrets.

> [!NOTE]
>
> The contact, acknowledgement time and patch timelines above are Quixa's standard terms; your contract may define different values, which then apply.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.