Security

How that trust is engineered.

You are trusting us with your research questions and decisions. Here is what is in place.

Tenant isolation, enforced twice

Every workspace's data is isolated at the application layer and by PostgreSQL row-level security. A missed filter in application code still cannot cross workspaces.

Credentials done right

Passwords are hashed with scrypt. API keys are stored as SHA-256 hashes and shown exactly once. Sessions are server-side and revocable instantly.

Least-privilege database access

The application connects as a restricted role subject to row-level security, never as the database owner.

Auditability

Every meaningful action (logins, role changes, key creation) lands in a per-workspace activity log, and every research query the assistant runs is recorded with its parameters, rows and errors for workspace administrators.

Payment data never touches us

Billing runs on Stripe Checkout and the Stripe customer portal; card details never reach our servers. Webhooks are signature-verified with replay protection.

Transport and headers

TLS everywhere, HSTS, frame-ancestors none, strict referrer policy, and per-request trace IDs on every response.

Found a vulnerability? Email security@quad99.com. We respond within one business day.