We store a few items in your browser to keep the site working (sign-in, language) and — only if you opt in — to count anonymous page views so we can improve the site. We use no third-party advertising cookies. See our privacy policy.
This page lists the security controls that exist in QUATA Digital's own systems today, what is not claimed, and how to report a vulnerability.
The site and the API send an HSTS header, so browsers use HTTPS.
Admin two-factor secrets and messaging credentials are stored encrypted. Admin sign-in locks after repeated failed attempts.
Admin actions are checked against named permissions.
Staff actions are recorded with who did them and from which IP address.
QUATA Digital Enterprise is registered under RC/BDA/2025A/189 · Tax ID M052517750267W. QUATAPAY is not a bank (see the terms of service).
This site does not claim PCI-DSS, ISO 27001, SOC 2 or any other security certification.
What we collect, why, who we share it with and your rights are in the privacy policy. Questions or requests: support@quatadigital.com.
We welcome reports from researchers and customers.
Email support@quatadigital.com with: a description, steps to reproduce, the impact you observed and any proof-of-concept artefacts. Please don't publicly disclose until we've had a chance to remediate.