Procurement Packet

Public diligence materials, procurement-review artifacts, and inherited-control boundaries for enterprise buyer review.

The procurement packet separates public diligence on the Qtonic Quantum platform, scoring methodology, and validation infrastructure from procurement-review artifacts and inherited provider controls. Public materials are available now. Review-only materials are provided during scoping and procurement review under mutual NDA when required.

Trust and procurement room

Follow the buyer question to the public record or one controlled request.

Public artifacts stay public. Buyer-specific questionnaires, architecture, and customer-authorized material use one governed diligence path.

Security architecturePublic

What is publicly reviewable, and what is not claimed?Reviewed 2026-08-15

Data handlingPublic

How does the public privacy and processing boundary work?Current public policy

Deployment boundaryPublic

Which product and service boundaries can a buyer inspect?Reviewed 2026-08-15

Sub-processorsPublic

Which listed providers support the public service boundary?Current public register

DPA and MSAPublic

Where are the public legal review surfaces?Current public record

Vulnerability disclosurePublic

How are reports submitted and coordinated?Current public policy

Runtime statusPublic

What public service state is being reported now?Live endpoint

Release proofPublic

Which exact build and linked service receipts are public?Live endpoint

Security questionnaireControlled request

Which buyer-specific architecture or control evidence requires governed review?Shared only after scope review

Cloud-provider certifications remain provider-held inherited controls, not Qtonic Quantum or QStrike attestations.

Customer-derived proof remains anonymized and is published separately on the case-studies route.

Procurement-review materials are provided under mutual NDA when the review scope requires them.

Inherited-control and proof mapping

Procurement review starts by separating control owners. Qtonic Quantum-owned platform proof, Zoho-held vendor assurance, and third-party review artifacts are evaluated under different evidence rules.

Buyer question	Owner	Public mapping	Boundary
Which controls are Qtonic Quantum-owned? Application and engagement controls	Qtonic Quantum control Public now	Access control, data handling, evidence boundaries, disclosure workflow, and engagement governance are Qtonic Quantum-owned controls. /trust/security-questionnaire	Public pages describe the control family. Completed questionnaires and architecture detail are shared during scoped review.
How should SOC 2 and ISO be evaluated? Inherited vendor assurance	Provider control Procurement review	Zoho SOC 2 and ISO assurance is provider-held infrastructure evidence used for inherited-control diligence. /trust/proof	These artifacts do not make Qtonic Quantum, QScout, or QStrike independently SOC 2 or ISO attested.
How is QScout evidence packaged? QScout public assessment proof	Qtonic Quantum control Public now	QScout publishes public assessment health, source-controlled synthetic proof, and manifest verification routes. /qscout/verify	Public proof demonstrates route and artifact behavior. Customer-specific scan detail remains consent-bound and scoped to the requester.
How is QStrike validation evidence packaged? QStrike governed proof	Qtonic Quantum control Public now	QStrike proof surfaces publish synthetic E2E status, engagement-bound evidence checks, and health-contract fields. /api/qstrike/health	Public proof is demonstration and platform evidence. Commercial challenge terms remain QStrike-only and contract-governed.
Which proof is cryptographically signed? Lab signed proof	Qtonic Quantum control Public now	Lab proof publishes signed manifest metadata, artifact hashes, and active proof-key material. /api/lab/health	Signed Lab artifacts prove the published Lab snapshot and hashes. They do not substitute for customer-specific acceptance testing.
Which independent reports are review-only? Independent and commercial review	Third-party artifact Procurement review	Infrastructure assessment summaries, insurance documents, and detailed vendor reports are controlled procurement-review materials. /procurement	Review-only materials are exchanged under the right commercial, NDA, and procurement controls.

Public materials available now

These materials are public and can be reviewed before any NDA process begins. Customer-derived proof stays on a separate route and remains anonymized and normalized for release.