# Security – QuiverAI > How QuiverAI handles your data today: retention modes, data controls, deletion, access controls, and transport security. Only what is true right now. - Canonical URL: https://quiver.ai/security/ Security # Security and data handling This page describes what QuiverAI does today, as shipped. Nothing here is a roadmap claim. Bring it to your security review, and send questions to . ## Data retention modes Every request runs under one of three inference data policies. The effective policy for your organization and each project is shown in the API Platform under Data Controls. * Allow storage and training Inference inputs and outputs may be stored and may be used to improve QuiverAI models. New organizations start here. * Allow storage for benchmarks only Inference inputs and outputs may be stored for quality benchmarks only. They are never used for model training. This applies once an organization turns off Improve QuiverAI in Data Controls, or a contract prohibits training. * Forbid storage Inference inputs and outputs are not stored beyond serving the request. This applies whenever customer content storage is prohibited, which only a contract sets. ## Data Controls disclosure The API Platform resolves four policy axes per organization and per project. The strictest explicit setting wins, prohibiting customer content storage also forbids storing inference data, and each statement shows its scope, source, and revision so you can cite it to support. Payload capture (prompts, request and response bodies, uploads, generated artifacts alongside request metadata) is pinned off. * Request metadata visibilityWhich customer-visible request metadata can appear in Request Logs, Usage dimensions, filters and exports. * Model trainingWhether QuiverAI may train its models on inference inputs and outputs. On by default for every organization. An Owner or Admin turns it off with Improve QuiverAI in Data Controls. A contract or compliance override can prohibit it, and it cannot be turned back on while one does. * Customer content storageWhether Customer Content may be stored. This is independent from request-metadata visibility and storage. * Request metadata storageWhether new durable request detail may be stored. Usage and lifecycle telemetry are separate. ## Account deletion Deleting your account first revokes your sessions and deletes your identity at our authentication provider, then anonymizes direct identifiers locally: email, names, usernames, auth identities, and profile fields. If provider cleanup fails, the deletion fails closed and can be retried; we do not leave accounts half deleted. A deleted account is never revived on a later sign-in; signing up again creates a fresh account. ## Upload retention Uploaded reference and source files are kept only while something still references them: an active generation task, a style version, or a public share. When the last reference is deleted, the upload is marked deleted and its stored object is removed. Deleting one creation from a task with other live creations does not remove the shared upload. ## Request IDs and rate limits Every API response carries an `X-Request-ID` header. Quote it when you contact support; it is the key we use to find your request. If you send an `X-Trace-ID`, it is echoed back. Rate-limited responses publish the following headers, all-or-none, once the request is attributed to a Platform organization: * X-RateLimit-Limit * X-RateLimit-Remaining * X-RateLimit-Reset * X-RateLimit-Scope * X-RateLimit-Subject * X-RateLimit-Dimension ## Transport and response headers All traffic is served over TLS. Every response from this site carries the headers below. * Strict-Transport-Security max-age=31536000; includeSubDomains * Content-Security-Policy frame-ancestors 'none' * X-Frame-Options DENY * X-Content-Type-Options nosniff * Referrer-Policy strict-origin-when-cross-origin * Permissions-Policy camera=(), geolocation=(), microphone=(), payment=(), usb=() ## API Platform access controls * Role-based access control Every organization member holds exactly one of four roles: Owner, Admin, Developer, or Viewer. Only the Owner can delete the organization; Owners and Admins manage members, invites, and projects. * API keys and service accounts API keys and service accounts have their own lifecycle. Keys are revealed once at creation and can be revoked at any time; deleting an organization stops every key in it. * Projects Projects scope keys and access grants inside an organization. Developers and Viewers only see the projects they are explicitly granted. * Audit timeline A read-only audit timeline for Owners and Admins records organization, membership, and key lifecycle events, including changes made by QuiverAI staff, which are marked as staff-initiated. ## Certifications and enterprise identity We do not hold third-party certifications today, and we do not offer single sign-on or directory sync. We would rather say so than imply otherwise. * SOC 2 Not yet * ISO 27001 Not yet * SSO / SAML Not available today * SCIM directory sync Not available today ## Reporting a vulnerability Email . Do not open a public issue. If a report needs a more secure channel than email, send a first message without the details and we will arrange one. Please include: * The affected product, URL or endpoint, and when you observed it * Steps to reproduce, with a proof of concept if you have one * The impact you believe it has * How we can reach you for follow-up ### In scope * QuiverAI API api.quiver.ai * API Platform platform.quiver.ai * App, including its MCP server and shares app.quiver.ai * Website and documentation quiver.ai, www\.quiver.ai, docs.quiver.ai Third-party services we use, denial-of-service and volumetric testing, social engineering, and best-practice findings without demonstrated impact are out of scope. For a host not listed here, report it and we will tell you whether it is in scope. ### Our response targets * Acknowledge your report 2 business days * Confirm or reject, with a severity and fix date 5 business days * Status updates until resolved At least every 14 days We fix confirmed issues within targets set by severity, and verify each fix before we close it. ### Testing in good faith Test only against accounts and organizations you own or have permission to use. Do not access, change, or delete data that is not yours; if you reach another customer's data, stop, keep no copy, and tell us right away. Do not degrade the service for others. Please do not disclose an issue publicly until it is fixed or the fix date we gave you has passed, and tell us the date first. We will not pursue legal action against good-faith research that follows these rules, and we credit reporters who want credit. We do not run a paid bug bounty. ## Running a security review? Send questionnaires and vulnerability reports to . For procurement and contract terms, talk to sales. [Email security](mailto:security@quiver.ai)[Contact sales](/sales)