Is Qdrant safe with your data?

Customer data is walled off from Qdrant's own use

The policy commits that Qdrant will not use data, information or material uploaded to the Cloud Service for its own business purposes, with carve-outs limited to supporting the customer's use, creating anonymized aggregated data, and cases the customer permits in writing. Model training is never mentioned anywhere in the policy.

Data subject rights are specific and article-cited

Access, correction, restriction, deletion, portability and objection are each tied to the GDPR article that grants them, portability specifies a structured, common and machine-readable format, access is free of charge, and direct-marketing objection routes to privacy@qdrant.com. A named external data protection officer at heyData GmbH is published with a postal address and email.

Retention is event-triggered rather than calendar-bound

Cloud Service personal data is kept as long as required and deleted upon termination or expiry of the customer agreement at the latest, subject to statutory retention. IP addresses in service log files are capped at 90 days, but the policy states the log files continue to be stored in anonymized form after the IP address is removed, with no end date.

Security, breach handling and policy change notice are thin

Encryption in transit is named as SSL, but everything beyond that is described only as appropriate technical and organizational measures, with no at-rest encryption, access control or certification named. The policy sets out no breach-notification commitment or timeframe, carries no version number or effective date, and promises only that a current version is always available.