Sell dataRequest data

Trust center

Built so personal data never has to move.

How Quarry de-identifies at the source, secures what it handles, and proves where every record came from.

Request documentsSystem status
rest
  1. 01

    At-source de-identification

    The pipeline runs inside the owner's environment. Raw recordings, DICOM and reports never reach Quarry or the lab.

  2. 02

    Chain of title

    Every delivered record maps to a signed supplier agreement and a buyer licence, in a per-record manifest.

  3. 03

    Least access

    People and systems get the narrowest access a task needs, and every dataset touch is logged.

  4. 04

    Honest status

    Compliance labels say what is done, in progress or planned. Nothing is claimed before it is true.

Can we sign with Quarry?

Here is where each framework stands today. A label only says done when it is done and evidenced.

Read the status ledger
#Framework or lawApplies toLaunch status
01India DPDP Act 2023 and DPDP Rules 2025Indian personal data in source systemsIn progressRules notified 13 Nov 2025; core obligations from 13 May 2027
02HIPAA (de-identification standards)US health dataApplied per datasetSafe Harbor or Expert Determination, named in each dataset's de-identification report
03GDPREU data, if anyPlanned
04SOC 2 Type IIQuarry's own controlsPlanned
05ISO 27001Quarry's own controlsPlanned

Read it your way.

Pick who is reading, and the path runs through the pages that reader needs, in order.

  1. 01De-identification and privacyHow personal data is removed, where, and how residual risk is tested
  2. 02SecurityInfrastructure, access, encryption, incident response, disclosure
  3. 03Provenance and licensingRights review, chain of title, permitted use, takedown
  4. 04ComplianceStatus per framework and law, with honest labels
  5. 05SubprocessorsWho processes data for Quarry, and change notices
  6. 06Request documentsSecurity questionnaires, reports and policies
Last updated 15 October 2026Questions? trust@quarrydata.ai