Authenticated accounts
Qubic uses Supabase authentication for account access. The public website signup requests an authentication email rather than collecting a password or payment details.
Security & data access
How Qubic controls access and payments
See how Qubic manages account and business access, how public links behave, and when eligible payments hand off to PayFast.
Business-scoped data access
The application uses business membership and row-level security rules to scope access to business records. Current roles are owner, admin, member and viewer.
Controlled public documents
Customers do not authenticate to open public quote and invoice experiences. A valid and currently available link exposes only the document information and customer actions available for the current workflow; it is not an authenticated customer portal.
Server-side payment checks
PayFast payment amounts and eligibility are determined server-side. Payment notifications are validated and handled idempotently before Qubic records the confirmed online result.
Business-owned PayFast account
Customer payment proceeds go through the business's connected PayFast merchant account. Qubic does not hold those customer funds or store raw customer card details.
Purpose-limited support access
Authorized support or platform personnel may access restricted account, business, team, client-name and diagnostic information when needed for support, payment readiness, document investigation, referral administration, invitation delivery or status investigation, and security or abuse investigation. That access is purpose based, not unrestricted.
Document and activity history
Qubic records relevant quote, invoice and payment status events used by the Activity view. This is not a promise that every action in the entire platform is logged.
Write-only payment credentials
Business PayFast credentials are entered through protected settings and returned to the interface in masked form rather than exposed as readable secrets.
What a public link means
Anyone who receives a valid and currently available public-document link may be able to view the information and use the customer actions available for that quote or invoice. These links are not authenticated customer portals. A link may stop working when a document is recalled, replaced, expired, closed or otherwise restricted, so businesses should share current links carefully.
See the customer experience →Infrastructure and privacy
Qubic currently uses service providers that include Vercel for website and application hosting and Supabase for authentication, database and file-storage services. This does not state a hosting region, data-residency guarantee, backup schedule, uptime commitment or disaster-recovery promise.
Read the Privacy Policy →Have a security question?
Contact Qubic before registering.