Security & Trust

• Email confirmation for new accounts, passwords of at least 8 characters checked against common passwords, and bot protection at sign-up.
• Rate limits on sign-in, sign-up, password resets and every paid tool, so accounts can’t be brute-forced or abused.
• Sign-in cookies are sent only over HTTPS in production and are protected against use from other sites.
• The admin console is limited to named administrators, and every admin action is written to an audit log.

• Encrypted in transit (HTTPS with HSTS) and encrypted at rest by our database and storage provider.
• Row-level security in the database: each request can read or change only the signed-in person’s own data, or data explicitly shared with their team.
• Uploads you keep are in private storage that only you, and your team when you share, can open. To run a job, the file is sent to the AI provider, which may hold a temporary copy at an unguessable address.
• Secret keys never reach your browser, and every release is scanned to make sure. API keys are stored only as secure hashes.
• Access tokens for accounts you connect (a YouTube channel, ad accounts) are encrypted before they are stored, tied to your account, and deleted when you disconnect.
• Privacy by design: presenter photos are deleted after each video (Runway’s terms still let it use inputs, including presenter photos, to train its models), face tracking runs on your device, and each AI provider receives only what one job needs.

• US dollar payments are handled by our payment partner, Dodo Payments, as merchant of record; rupee payments are processed for us by Razorpay. We never see or store your card number, UPI PIN or bank login, and payment notifications are verified with signatures before any credits are added.
• Every price is calculated on our server, never trusted from the browser, and uploads are measured from the file itself before any charge.
• Failed or timed-out runs are refunded automatically (the one exception is a provider-charged safety refusal), and unfinished provider jobs are cancelled so nobody pays for work that isn’t delivered. Every paid run is recorded when it is charged, so one whose server stops part-way is refunded automatically after its time limit, exactly once.

• Requests are checked for prohibited content before they run, including requests to depict or voice public figures.
• Faces and voices of real people need a recorded consent confirmation, and voices saved for reuse need a spoken consent from their owner.
• Realistic outputs carry a visible AI label, and generated files carry content credentials that anyone can check. See AI Labels & Content Credentials.
• Reports of intimate imagery disable the reported file across QikTools, pending review; the copy we store is deleted and kept only as evidence in a private store.

• Security headers on every page: no framing by other sites, strict referrer and content-type rules, and limited browser permissions.
• Links you give us (websites, images, audio) are fetched through a guarded client that refuses private and internal network addresses.
• Strict limits on every input (text length, file size, audio length, image size and document structure) before any work starts.
• Regular reviews of the code for payment, money and data-access risks, with findings fixed before release.

• Check the address bar before you sign in: it should show www.qiktools.com. When you pay, you’re taken from our site to our payment partner’s secure checkout, the only place you ever enter card details.
• We never ask you for your password or card details by email, chat or phone, and no message from us will ever ask you to reply with them.
• Seen a fake site, app, message or account using our name? Tell us at hello@qiktools.com or with the report form, and don’t enter any details there.

We investigate every security report and every suspected incident. If an incident affects personal data:

• we tell the people affected without undue delay, with what happened and what they can do;
• we report reportable cyber-security incidents to CERT-In, India’s computer emergency response team, within 6 hours;
• we inform the Data Protection Board of India and send it a detailed report within 72 hours;
• where the GDPR applies, we notify the relevant data protection authority within 72 hours.

Email hello@qiktools.com with “Security report” in the subject and enough detail to reproduce the issue. We reply within 72 hours and keep you updated until it’s fixed. The same contact is published in our security.txt file.

We won’t take legal action against good-faith research that avoids privacy violations, data destruction and service disruption, doesn’t access other people’s data beyond what’s needed to show the issue, and gives us reasonable time to fix it before disclosure.

The Trust Center brings our security, privacy and AI safety measures together, with answers to common security questionnaire questions. See the Privacy Policy for how we handle personal data, and the Third-Party Processors page for every provider we use.