Trust & compliance
Security & compliance at Queuey
Queuey carries your events — which means it carries your customers' data. This page describes how that data is protected: where it lives, who can touch it, how it is isolated and encrypted, and what our GDPR posture is. It is written to answer the questions an enterprise security review actually asks, and we keep it honest — including about what we don't have yet.
Hosted on Microsoft Azure in the Norway East region. Primary processing of customer data stays inside the EEA.
Every tenant gets its own database schema, and all access is scoped per tenant — one tenant can never read another's data.
TLS on ingress, delivery, console, and API. Data at rest is encrypted by Azure's managed-database platform encryption.
Built and operated from Norway under the GDPR. An Article 28 Data Processing Agreement with EU Standard Contractual Clauses backs enterprise use.
Retention is configurable per license — keep events for N days or forever. Expired data is deleted by an automated daily job.
API keys, HMAC signed requests, and source-IP allowlists on the way in; HMAC signatures and OAuth2 (incl. private_key_jwt) on the way out.
Data residency & hosting
Queuey runs on Microsoft Azure in the Norway East region — inside the EEA — including its managed databases and backups. Primary processing of customer data takes place within the EEA, and no customer data is transferred outside the EEA (by Queuey or a sub-processor) unless a GDPR Chapter V safeguard — an adequacy decision or the EU Standard Contractual Clauses with supplementary measures — is in place for that transfer first. Two named sub-processors process limited data in the United States under those clauses: Resend (notification e-mail — recipients and operational notification content, never event payloads) and OpenAI (AI-assisted failure analysis, only where you enable it per queue). Both are listed in the DPA and in the sub-processor table on this page.
Queuey is a Norwegian company. Agreements are governed by Norwegian law, and the competent supervisory authority is the Norwegian Data Protection Authority (Datatilsynet).
Tenant isolation & access control
- Schema-per-tenant. Every tenant's data lives in its own database schema, and each connection is scoped to exactly one tenant's schema. Cross-tenant reads are not a query-filter discipline — they are structurally impossible.
- Scoped credentials. API keys belong to a tenant and can be scoped down to a queue. Keys can be rotated and revoked in the console at any time.
- Federated console sign-in. The console authenticates through Microsoft Entra ID; Queuey stores no passwords.
- Least privilege internally. Production access is limited to authorised personnel on a need-to-know basis, under confidentiality obligations.
- Authorised distribution only. Under WaaS event distribution, an event flows from a producer to a subscribing tenant only where the producer's own configuration authorises that delivery.
Product security controls
Security is part of the delivery pipeline itself, not a bolt-on:
- Ingress authentication — API keys or HMAC signed requests (HMAC-SHA256 over a canonical string, with replay protection).
- Network gate — a per-queue source-IP CIDR allowlist evaluated against the real client IP, before any authentication runs.
- Signed deliveries — outbound requests can carry an HMAC signature your receiver verifies in constant time, proving origin and integrity.
- Delivery-side auth — OAuth2 client credentials against your target, including private_key_jwt with a P12 certificate for regulated receivers.
- Duplicate-safety — idempotency-based dedup at ingress, key threading outbound, and Hold-on-timeout as the safe default for non-idempotent endpoints.
- Loop prevention — the X-Queuey-Path hop chain and cycle detection stop events from circulating forever between queues.
- Sandbox separation — test traffic runs in a sandbox separated from production processing.
GDPR & data protection
For the event data you send through Queuey, you are the controller (or a processor for your own customers) and Queuey is a processor: we process that data only on your documented instructions — constituted by your configuration of queues, endpoints, policies, and retention — and never for our own purposes.
- A GDPR Article 28 DPA with schedules for processing details, technical and organisational measures, sub-processors, and international transfers (EU SCCs 2021/914) is part of the commercial agreement.
- Sub-processor changes come with at least 30 days' prior notice and a right to object.
- Breach notification without undue delay — where feasible within 72 hours of Queuey becoming aware.
- Data-subject requests — the console, API and SDK let you access, correct, export and delete data self-serve; Queuey assists where self-service can't reasonably reach.
- Deletion on exit — 30-day export window after termination, then deletion from production systems.
Retention, export & deletion
Retention is yours to configure, per license: keep event data for a fixed number of days, or keep it forever. An automated job enforces the policy daily — expired events, delivery attempts and metrics are deleted, not just hidden. During the subscription you can export and delete data at any time through the console and API.
Sub-processors
Queuey uses a deliberately short list of sub-processors:
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Microsoft Azure | Cloud hosting and managed database | Norway East (EEA) |
| Stripe | Payment and billing processing | EEA entity (Stripe Payments Europe) |
| Resend | Transactional and notification email | United States |
| OpenAI | AI-assisted failure analysis — engaged only where a queue's AI data control is set to Shape or Full; never when Off | EEA (OpenAI Ireland Ltd); onward transfer to the United States under the EU Standard Contractual Clauses |
Email (Resend) is used for account and alert notifications — not for the contents of your event payloads. Sub-processor additions or replacements are announced at least 30 days in advance, with a contractual right to object.
Certifications & audits — the honest version
Queuey does not yet hold ISO/IEC 27001 or SOC 2, and we won't pretend otherwise with borrowed badge walls. What we offer today: written answers to your security questionnaire, the information needed to demonstrate GDPR Article 28 compliance, and contractual audit rights in the DPA. As certifications are attained they will be listed here — and not a day before.
Reporting a vulnerability
If you believe you have found a security vulnerability in Queuey, email security@queuey.ai with enough detail to reproduce it. We ask that you give us a reasonable window to remediate before public disclosure, and that testing never targets data belonging to other tenants. We do not take legal action against good-faith research conducted under these rules.
Receiving unwanted traffic from Queuey?
Queuey delivers webhooks on behalf of our customers. If your server is receiving traffic you did not ask for, you can always identify it: every request we send carries the User-Agent Queuey-Delivery/1.0 (+https://queuey.ai/abuse) — this identification cannot be disabled by the sender.
Email abuse@queuey.ai with the URL being hit, a rough time window, and — if present — the values of any X-Queuey-Path or X-Queuey-Event-Id headers from the requests. Those values let us trace the traffic to its exact source queue immediately. We investigate every report, suspend the offending queue at the platform level (the sender cannot lift the suspension), and reply to you with the outcome. Note that our delivery engine also throttles itself automatically: endpoints that reject or fail traffic are rapidly backed off to a slow probe cadence rather than hammered.
Enterprise security FAQ
Where is our data stored and processed?
On Microsoft Azure in the Norway East region, inside the EEA. Queuey does not move customer data outside the EEA without an appropriate GDPR Chapter V safeguard (adequacy decision or Standard Contractual Clauses) in place first.
Is our data encrypted?
Yes. All traffic — ingress, delivery to your endpoints, the console, and the API — runs over TLS. Data at rest in the managed database and its backups is encrypted by Azure platform encryption. Outbound deliveries can additionally be HMAC-signed so your receiver can verify authenticity and integrity.
Does Queuey use AI, and does it see our event data?
Only if you let it. Each queue has an AI data control: Off (nothing leaves Queuey), Shape (payload structure only, values masked) or Full. Under Shape or Full, failure analysis is performed by OpenAI — OpenAI Ireland Ltd, with onward transfer to the United States under the EU Standard Contractual Clauses — and model outputs are not retained by the provider for training. Delivery decisions themselves are rule-based and never made by a model, and every AI read of payload content is recorded in your payload access log.
How is our data isolated from other tenants?
Each tenant has its own database schema, and every connection is scoped to that tenant's schema. API keys are scoped to a tenant (and can be scoped to a queue), so a credential for one tenant cannot touch another. In WaaS event distribution, an event only reaches a subscriber the producer's configuration explicitly authorises.
Who at Queuey can access our data?
Access to production and customer data is restricted to authorised personnel on a need-to-know basis, under confidentiality obligations and the principle of least privilege. Queuey processes your event data only as a processor, on your documented instructions — never for its own purposes, and it is never sold.
Do you offer a Data Processing Agreement (DPA)?
Yes. A GDPR Article 28 DPA — covering processing details, technical and organisational measures, sub-processors with a 30-day change notice and right to object, and EU Standard Contractual Clauses for any transfer out of the EEA — is part of the commercial agreement. Contact legal@queuey.ai.
What happens if there is a data breach?
Queuey notifies affected customers without undue delay after becoming aware of a personal-data breach — where feasible within 72 hours — including the nature of the breach, likely consequences, and the measures taken, and cooperates with your investigation and any supervisory-authority notification.
How do we get our data out, and what happens when we leave?
You can access, export, and delete your data self-serve through the console and API for the whole subscription. On termination, data remains exportable for 30 days, after which it is deleted from production systems; backup copies age out with the backup rotation cycle.
Do you hold ISO 27001 or SOC 2?
Not yet — Queuey does not currently claim certifications it does not hold. We answer security questionnaires, make information available to demonstrate GDPR Article 28 compliance, and the DPA grants contractual audit rights. Certifications will be pursued as the company grows; this page will state them when they are real.
Can we restrict who is able to send events to our queues?
Yes — three gates, combinable: a per-queue source-IP (CIDR) allowlist evaluated before authentication, tenant-scoped API keys, and HMAC signed-request authentication with replay protection.
How do users sign in to the console?
Console sign-in is federated through Microsoft Entra ID — Queuey does not store passwords. Programmatic access uses per-tenant API keys you can rotate and revoke in the console.
Can duplicate deliveries cause duplicate side effects in our systems?
Queuey is built to prevent it: inbound deduplication on the Idempotency-Key, outbound key threading to your receiver, and a safe Hold-on-timeout default so a non-idempotent endpoint is never blindly retried after an ambiguous failure.
Is Queuey available to consumers?
No. The service is offered exclusively to businesses and organisations (B2B), under Norwegian law with Trøndelag District Court (Trondheim) as venue.
Contact
- Security reports — security@queuey.ai
- Privacy & data protection — privacy@queuey.ai
- DPA, agreements & questionnaires — legal@queuey.ai
- Abuse — abuse@queuey.ai