Listed
CSA STAR Level 1
Self-assessment against the Cloud Controls Matrix (CAIQ v4.1.0), listed in the CSA STAR Registry since 19 October 2026. This is a self-assessment, not an independent audit. View our registry entry.
MoleQuant LLC · Trust Center
How MoleQuant protects your formulas.
A formulation is a client’s most valuable intellectual property. This page shows how we protect it, what we have assessed, and what is still in progress. Every item carries its real status — including the ones that are not finished.
Hosted in
Doha, Qatar on Google Cloud
Client separation
Every query scoped to one client
Encryption
AES-256 at rest, TLS in transit
Backups
Daily, encrypted, off the server
Assurance
What we have assessed, and what we have not
MoleQuant holds no independent certification today. We have assessed ourselves against recognised frameworks and say plainly where each one stands.
Aligned
Qatar PDPPL and QFC rules
Data protection policy approved and self-assessed against Law No. 13 of 2016 and the QFC Data Protection Regulations 2021. MoleQuant LLC is registered in the QFC.
Not certified
ISO/IEC 27001:2022
Statement of Applicability drafted across all 93 Annex A controls as a readiness step, with each control carrying its own status. No certification audit has taken place.
Planned
Independent penetration test
An independent test of the platform, including client separation and key handling, is planned for Q1 2027. No external test has been done yet.
Controls
Security controls and their status
“In place” means it works today. “In progress” means it is partly done, or written and approved but not yet enforced by the platform. “Planned” means not started. Use the filters to see only one status.
Target architecture, planned for Q1 2027: each client with its own database, container and encryption key. Today every query is scoped to a single client inside one database, and automated separation tests are being added.
Reviewed 20 October 2026
Control monitoring
Each control below is checked and dated. Today these checks are done by hand by our CTO. We plan to move the ones that can be automated (encryption in transit, backups, access) to daily automated tests, and this page will say so when we do.
Passed the last reviewOpen item or not yet fully verifiedPlanned, not started
Documents
Policy library
These documents are approved at version 1.0. We share them under NDA. Select the ones you need, then send us the request — you can copy it or open it in your email app.
Sub-processors
Who handles data on our behalf
This is the complete list. We tell clients about changes to it as their agreements require.
| Provider | What it does for us | Where | Data involved |
|---|---|---|---|
| Google Cloud (including Vertex AI) | Hosting, storage, backups, logs and AI services | Doha, Qatar (hosting) | Client and platform data |
| Anthropic (Claude API) | Generates the text of strategies in the second stage of the pipeline. It never produces a quantity or an identifier a client acts on. | May be processed outside Qatar | Text needed for that step |
| HubSpot | Sales contact management, and the enquiry form on our public website | Provider’s regions | Prospect contact details only. No client formulas. |
| Google Analytics | Measures traffic to our public website | Provider’s regions | Website visit data (pages viewed, device, approximate location). No client data. |
| Microsoft Clarity | Shows how visitors use our public website (heatmaps and session replays) | Provider’s regions | Website visit behaviour. No client data. |
Questions
Common questions
Where is my data stored?
On Google Cloud in Doha, Qatar. Daily encrypted backups are kept off the production server. Google Cloud provides the physical security of the data centre.
Can other clients see my data?
No client can reach another client’s data through the product. Every query is scoped to a single client, staff access is role-based and logged, and administrator accounts are separate from client accounts. Two things are in progress and we would rather say so: automated tests that assert the separation on every release, and giving each client its own database, container and encryption key. Both are scheduled — see the status of each in Controls.
Do you use my data to train AI models?
No. MoleQuant does not train or fine-tune models on client data, and there is no training step in the product at all. Text needed for the strategy step is sent to Anthropic’s Claude API, a listed sub-processor that may process it outside Qatar.
Can the AI invent a number in my report?
Not in the parts that are guarded, and that is enforced by the design rather than by instructions. Emission factors, patent records and material prices are retrieved from named sources first; the response format has no field that can hold an invented quantity, and the renderer prints the retrieved record rather than the model’s reply. Where a document type is not yet covered by that mechanism, a MoleQuant expert reviews it before release and the coverage work is listed as in progress.
Is MoleQuant ISO 27001 or SOC 2 certified?
No. We are listed in the CSA STAR Registry at Level 1 (a self-assessment) and have drafted a Statement of Applicability for ISO/IEC 27001:2022. We have no certification or independent audit yet and do not claim one.
What happens to my data when the contract ends?
Our approved retention policy gives you 90 days to request an export, then deletes client data and confirms the deletion in writing; backups clear within a further 35 days. The policy is approved at version 1.0 and the export and deletion are carried out by our technical lead on request. Automating both, with a deletion register, is in progress.
Which laws do you follow?
Qatar’s Personal Data Privacy Protection Law (Law No. 13 of 2016) and, as a company registered in the Qatar Financial Centre, the QFC Data Protection Regulations 2021.
How do I report a vulnerability?
Email security@molequant.com with the details and how to reach you. Please do not access client data or disrupt the service while testing. We will acknowledge it and tell you what we find.
Contact
Security and privacy contact
Security and privacy
Report an issue, ask a security question, or make a privacy request.
security@molequant.com
Company
MoleQuant LLC
Doha, Qatar
Registered in the Qatar Financial Centre, QFC No. 04865