Money changes hands here. We built for that
Quid sits between companies, sellers, and charities and moves real money between them. Trust isn't a feature we bolt on. It's the whole product. Here's exactly how we protect it.
The money path is the part that has to be right.
We never see your card.
Cards are tokenized by Stripe Elements in the browser. Raw card numbers never touch Quid's servers, logs, or database. Stripe is PCI-DSS Level 1 certified, the highest tier there is.
You're never charged for a meeting that didn't happen.
A pitch places a hold on the card, not a charge. Money is only captured when the decision-maker confirms they joined the meeting. No meeting, no capture: the hold is released automatically.
The split is conserved to the penny.
The company share, Quid's take, and the charity slice always sum to exactly what was captured. There's no rounding leak, and reconciliation jobs run daily to catch any drift.
Nothing moves on an unverified event.
Every incoming payment event is cryptographically signature-verified and fails closed if it can't be. A forged or replayed webhook can't move a dollar.
Your data is isolated by default.
Quid runs on managed Postgres with row-level security on every table. Access rules are enforced by the database itself, not just the app, so one company's data can't be reached from another's session even if application code were wrong.
Everything is encrypted in transit (TLS) and at rest. Secrets and service credentials live only on the server and are never shipped into the browser bundle.
We build on providers that carry the certifications so you don't take our word for it: payments on Stripe (PCI-DSS Level 1), data and hosting on Supabase and Vercel (SOC 2). Quid inherits their posture and adds its own controls on top.