Security

Security and data handling

This page describes what QuiverAI does today, as shipped. Nothing here is a roadmap claim. Bring it to your security review, and send questions to security@quiver.ai.

Data retention modes

Every request runs under one of three inference data policies. The effective policy for your organization and each project is shown in the API Platform under Data Controls.

Allow storage and training: Inference inputs and outputs may be stored and may be used to improve QuiverAI models. This is the platform default for new organizations.
Allow storage for benchmarks only: Inference inputs and outputs may be stored for quality benchmarks only. They are never used for model training.
Forbid storage: Inference inputs and outputs are not stored beyond serving the request.

Data Controls disclosure

The console resolves five independent policy axes per organization and per project. The strictest explicit setting wins, and each statement shows its scope, source, and revision so you can cite it to support. Payload capture (prompts, request and response bodies, uploads, generated artifacts alongside request metadata) is pinned off.

Request metadata visibilityWhich customer-visible request metadata can appear in Request Logs, Usage dimensions, filters and exports.
Inference data policyWhether QuiverAI may use inference inputs and outputs for storage, benchmarks or training.
Customer content storageWhether Customer Content may be stored. This is independent from request-metadata visibility and storage.
Request metadata storageWhether new durable request detail may be stored. Usage and lifecycle telemetry are separate.
Training consentWhether your organization allows QuiverAI to improve its models from your usage. An organization-level toggle that a contract can pin to opted out.

Account deletion

Deleting your account first revokes your sessions and deletes your identity at our authentication provider, then anonymizes direct identifiers locally: email, names, usernames, auth identities, and profile fields. If provider cleanup fails, the deletion fails closed and can be retried; we do not leave accounts half deleted. A deleted account is never revived on a later sign-in; signing up again creates a fresh account.

Upload retention

Uploaded reference and source files are kept only while something still references them: an active generation task, a style version, or a public share. When the last reference is deleted, the upload is marked deleted and its stored object is removed. Deleting one creation from a task with other live creations does not remove the shared upload.

Request IDs and rate limits

Every API response carries an X-Request-ID header. Quote it when you contact support; it is the key we use to find your request. If you send an X-Trace-ID, it is echoed back.

Rate-limited responses publish the following headers, all-or-none, once the request is attributed to a Platform organization:

X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset
X-RateLimit-Scope
X-RateLimit-Subject
X-RateLimit-Dimension

Transport and response headers

All traffic is served over TLS. Every response from this site carries the headers below.

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), geolocation=(), microphone=(), payment=(), usb=()

Access controls in the console

Role-based access control: Every organization member holds exactly one of four roles: Owner, Admin, Developer, or Viewer. Only the Owner can delete the organization; Owners and Admins manage members, invites, and projects.
API keys and service accounts: API keys and service accounts have their own lifecycle. Keys are revealed once at creation and can be revoked at any time; deleting an organization stops every key in it.
Projects: Projects scope keys and access grants inside an organization. Developers and Viewers only see the projects they are explicitly granted.
Audit timeline: A read-only audit timeline for Owners and Admins records organization, membership, and key lifecycle events, including changes made by QuiverAI staff, which are marked as staff-initiated.

Certifications and enterprise identity

We do not hold third-party certifications today, and we do not offer single sign-on or directory sync. We would rather say so than imply otherwise.

SOC 2: Not yet
ISO 27001: Not yet
SSO / SAML: Not available today
SCIM directory sync: Not available today

Running a security review?

Send questionnaires and vulnerability reports to security@quiver.ai. For procurement and contract terms, talk to sales.

Email security Contact sales