How QualiFlow protects dealership data

Every request is checked so people see only their own dealership and the locations they may access. Underneath that, the database enforces the same separation with row-level security policies on the tables that hold dealership data. The policies are keyed to the dealership's workspace, so a query can only return rows that belong to the workspace it runs for.

• The app connects with a database role that is not allowed to bypass those policies.
• The database has no public network port; only the app reaches it.
• A customer's remembered details are never shared between customers or between dealerships.

The credentials QualiFlow holds for your connected mailboxes, calendars and messaging channels are encrypted with AES-256-GCM. The keys live in a keyring file on the server, outside the database and readable only by the app, so a copy of the database alone cannot decrypt them. The keyring holds an active key plus older keys, so keys can be rotated without losing access.

• Passwords are stored only as salted scrypt hashes, never in readable form.
• Authenticator secrets for 2-step verification are encrypted with a server key the database never holds.
• All traffic uses HTTPS, with HSTS. Signatures on messages from our providers are verified, so forged ones are rejected.
• Application logs leave out message content, passwords and tokens.

A full backup of the database and private files runs every night. Each backup is encrypted with AES-256-GCM, then decrypted and hash-checked before it is kept. The newest 14 nightly and 4 weekly backups are retained.

Every week an automatic restore test decrypts the newest backup into a throwaway database with no network, restores it, and compares every table, row count and row-level security policy with what the backup recorded. Then the test copy is deleted.

Today these backups are kept on the production server. An encrypted off-server copy is planned and not yet switched on.

QualiFlow runs on a dedicated server in a US data center. The app runs in read-only containers with every extra system privilege removed, behind a web server that handles HTTPS.

Some service providers, such as messaging, calling, email and AI model providers, process data to deliver the service. They are listed in our Privacy Policy.

A STOP reply, and a wrong-number report, is handled before Aria ever sees the message. Permission to contact is recorded separately for each channel and purpose, with its evidence, and it is checked again right before every message goes out.

• A text STOP stops all texts. Service messages then continue by email if the customer has an address.
• A marketing unsubscribe stops marketing only; it never stops service messages such as appointment reminders.
• Having an email address or phone number is not permission, and importing a list never grants permission to contact.
• Automated texts carry “Reply STOP to opt out.”

Every email to a customer is sent from the dealership's own connected Gmail or Outlook mailbox, or from an address on the dealership's own verified domain. It is never sent from a QualiFlow address. If no dealership sender is connected, no customer email goes out at all.

QualiFlow's own address is used only for staff account emails, such as sign-in codes.

Aria is one AI model working through fixed server tools. When Aria wants to book, record or send something, code does it and returns a receipt. Aria may only say something was booked, recorded or sent when that receipt proves it; the server removes any outcome claim no receipt backs.

• Every reply is checked against your dealership's records before it is sent. A reply that states something the records don't support is rewritten once, or replaced by a short standard line.
• Aria never invents prices, stock, discounts or finance terms, and passes discount and finance questions to your team.
• Consent, opt-outs, allowed hours and approvals are enforced by the server, never by the AI's instructions alone.
• You choose Off, Ask first or Autopilot, and staff can take over any conversation.

Owners choose what Aria keeps from a call: nothing, a short summary (the default), or a full transcript with a summary. Call recording is a separate choice and stays off for Aria's calls unless an Owner turns it on. Calls your team starts from a contact follow the same Settings → Calls choice, and the customer hears that the call is recorded before being connected. Nobody is recorded silently: at the start of every call, Aria tells the caller what the call keeps, in the caller's language.

• If a caller asks to stop, both the transcript and the recording stop at that moment, and that call's recording is deleted.
• Recordings are copied into QualiFlow's private storage and deleted from the phone provider. They play inside QualiFlow only, with no download button and no public link.

When a customer asks about their data, an Owner can download everything QualiFlow holds about that contact, place a legal hold, or erase the contact. Erasing removes their details, message text, call summaries, transcripts and recordings, including the phone provider's copy. Consent, delivery and audit records are kept without the person's details, and an erased contact can't be messaged again.

• Erasing needs the Owner to confirm it's them and to type ERASE; a legal hold blocks it.
• Every export and erasure is recorded in the audit log.
• Owners can also export contacts as CSV, up to 5,000 at a time.