Security questionnaire

Who provides the service?

QikTools is a trade name of Sarthak Daruka, an individual carrying on business in India as a sole proprietor. Principal place of business: Asansol, Paschim Bardhaman, West Bengal, India.

Grievance Officer & Contact

Who is responsible for security and privacy?

The proprietor, Sarthak Daruka, is responsible for security and privacy. Our Grievance Officer, Sarthak Daruka (hello@qiktools.com), handles privacy requests and complaints.

Do you have written security and privacy policies?

Yes, and they are public: the Privacy Policy, the Security & Trust page, the AI & Acceptable Use Policy, the Cookie Policy, the Data Processing Agreement and the Report & Takedown Policy. Each shows its date and version, and we update them when the Service or the law changes.

Legal Center

Who can access customer data?

The proprietor and anyone else we authorise to help run the Service, each bound by confidentiality and given only the access their work needs. Customer data is never shared with advertisers or data brokers.

How do people sign in?

With an email address and password (confirmed by email), with Google or Microsoft where those options are switched on, or through their company’s single sign-on (SAML) for teams.

What are your password rules?

New passwords need at least 8 characters and are checked against a list of commonly guessed passwords. Our sign-in provider, Supabase, stores passwords only as secure hashes; we never see them. Sign-in, sign-up and password resets are rate-limited, and sign-up has bot protection.

Do you support multi-factor authentication (MFA)?

Not yet for email-and-password accounts. Teams that sign in through their company’s single sign-on use their identity provider’s own MFA rules.

How are sessions protected?

Sign-in cookies are marked Secure in production, so they are only sent over HTTPS, and SameSite=Lax, so other sites can’t send them with a form post. Requests that change data are also refused when they come from another site.

Can teams control who has access?

Yes. Team owners invite and remove members and set roles, custom permissions, approval steps and spending limits. Teams can verify their company domain, require single sign-on for it and provision members automatically with SCIM; single sign-on and SCIM are set up with us on request.

How is administrative access controlled?

The admin console is limited to a named list of administrators set in server configuration. Accounts that sign in with single sign-on can never be administrators, and every admin action is written to an audit log.

How are API keys handled?

API keys are stored only as secure hashes plus their first characters, so we can’t read them back. Customers can revoke a key at any time, and requests are rate-limited per account.

Developer API

Is data encrypted in transit?

Yes. Every page and API is served over HTTPS (TLS), with HSTS in production so browsers refuse plain HTTP. Calls to our providers’ APIs also use HTTPS.

Is data encrypted at rest?

Yes. Our database and file storage host, Supabase, encrypts the data it stores for us at rest with AES-256. Generated files hosted by our AI providers are stored on their infrastructure under their terms.

How are secrets and keys managed?

Provider keys and other secrets are kept in server-side environment settings, never in source code or in anything a browser downloads. Every production build is scanned automatically and fails if a server secret appears in browser files.

How are access tokens for connected accounts stored?

When a customer connects a YouTube channel or an ad account, the access tokens we receive are encrypted in the application with AES-256-GCM, under keys derived from a master key that exists only in our server settings, and each token is bound to the person and account it belongs to, so it can’t be replayed on another record. The database never holds a token in plain text. Disconnecting deletes the tokens and asks the platform to revoke the access.

Where is customer data stored?

Our database and file storage run on Supabase, on Amazon Web Services in our project’s region. Generated files are hosted by our AI providers, mainly in the United States. Our web host is named on our processors page before launch.

Third-Party Processors

Is each customer’s data kept separate?

Yes. Row-level security on every database table means each request can read or change only the signed-in person’s own data, or data explicitly shared with their team. Uploads you keep are in private storage that only you, and your team when you share, can open. To run a job, the file is sent to the AI provider, which may hold a temporary copy at an unguessable address.

Which security headers do you send?

Every page blocks framing by other sites (X-Frame-Options: DENY and frame-ancestors 'none'), blocks plugins, <base> tags and off-site form targets, sends X-Content-Type-Options: nosniff, a strict referrer policy and a permissions policy that blocks the camera, location and payment APIs, and sends HSTS in production. We don’t yet send a full script Content Security Policy, because our in-browser video tools need one that is more relaxed.

How do you prevent common web attacks?

Every input is validated and size-limited before any work starts; database access goes through Supabase’s query interface with row-level security; requests that change data are refused when they come from other sites; customer and AI content is never rendered as raw HTML; and links a customer gives us are fetched through a guarded client that refuses private and internal network addresses.

Do you review your code for security?

Yes. We run internal reviews focused on data access, payments and abuse, including attack tests of our database rules, storage, server-side request forgery and payment races, and fix findings before release.

How do you manage vulnerable dependencies?

We keep dependencies current and act on npm audit findings, for example by pinning fixed versions. We don’t yet run an automated dependency-scanning service.

What do you log, and for how long?

Sign-in and request logs, rate-limit counters, admin actions, refused requests (the category and a one-way fingerprint of the text, never the text itself), payment events and provider costs. Safety and sign-up records are kept for 1 year; server and sign-in logs are kept by our hosting providers under their retention settings. Other periods are in our retention schedule.

Retention schedule

Do you monitor for abuse and fraud?

Yes. Automated daily checks look for fraud signals (many sign-ups from one network, refund loops, payment disputes, unusual spending) and overdue reports, and alert us. Repeated or critical safety refusals restrict an account automatically until a person reviews it.

Do you have an incident response process?

Yes. We investigate every security report and suspected incident. Affected customers are told without undue delay, and business customers under our DPA within 48 hours. Reportable incidents go to CERT-In (India) within 6 hours and to the Data Protection Board of India with a detailed report within 72 hours; where the GDPR applies to us as a controller, to the relevant authority within 72 hours.

How can someone report a vulnerability?

Email hello@qiktools.com with “Security report” in the subject, or see our security.txt file. We reply within 72 hours and don’t take legal action against good-faith research that respects people’s privacy and gives us reasonable time to fix the issue.

Report a vulnerabilitysecurity.txt

Do you back up customer data?

Our database runs on Supabase, a managed service; ask us for the current backup schedule. Generated files are hosted by our AI providers, so download or save to your library anything you need to keep.

What happens if an AI provider fails or is unavailable?

A run that fails is refunded in credits automatically; the one exception is a provider-charged safety refusal, explained in our Terms. Long jobs are checked with the provider before anything is refunded, and are cancelled there when we give up. Many tools offer a choice of models, and we move a tool to another model when one is retired.

Provider safety refusals

Do you offer an uptime commitment (SLA)?

Not yet. Our Terms don’t promise uninterrupted service. We run on managed hosting and database services.

How long do you keep customer data?

Account data while the account is open; projects and saved files until they are deleted (Free-plan projects are deleted after 15 days without edits); records of refused requests and sign-up checks 1 year, strikes and restrictions up to 3 years; consent evidence 6 years after last use; provenance records 6 years; AI text fingerprints 3 years; purchase records up to 8 years. The full schedule is in our Privacy Policy.

Retention schedule

Can customers export and delete their data themselves?

Yes. Settings → Profile → Download my data gives a machine-readable copy of the account’s data, and Settings → Delete account removes the account and its data, apart from the records in our retention schedule that we must or may keep, and generated files on our AI providers’ networks, which they remove on their own schedules.

What happens to data after an account is deleted?

It is deleted from our live systems, and copies in backups cycle out within 30 days. Records we must keep, such as provenance records, consent evidence, evidence of removed content and tax records, are kept for the periods in our retention schedule. Generated files on our AI providers’ delivery networks are removed on those providers’ own schedules.

Do you use sub-processors?

Yes. Every provider that processes personal data is listed publicly with what it receives, where it is and, for AI providers, whether its terms let it train on content.

Third-Party Processors

How do you announce sub-processor changes?

We update the list and its RSS feed at least 14 days before a new sub-processor starts processing personal data for business customers, except in an emergency. Anyone can subscribe to the feed for free.

RSS feed

Do you transfer data outside the customer’s country?

Yes. We are based in India. Our providers work mainly in the United States; some model developers reached through Fal and Runway are based elsewhere, including China and Singapore (see the processors page). For transfers under the GDPR, our DPA incorporates the EU Standard Contractual Clauses, with the UK Addendum and the Swiss changes, and we rely on our providers’ data processing terms for onward transfers.

Do you sell personal data or use it for advertising?

No. We never sell personal data, don’t share it with advertisers or data brokers, and don’t use advertising, analytics or tracking cookies.

Privacy Policy

Is there a Data Processing Agreement?

Yes: GDPR Article 28 processor terms with the EU Standard Contractual Clauses for transfers and an India DPDP addendum. It is part of our Terms for business customers and can be downloaded as a PDF.

Data Processing Agreement

Do you connect to customers’ accounts at other companies?

Only when a customer chooses to, and only through that company’s own sign-in screen: a YouTube channel for Video Dubbing Autopilot (once channel connections are switched on), Google Drive and Dropbox file pickers that hand us the one video the customer picks, and Meta, TikTok or Google Ads accounts for the Winning Ads Loop (once ad-account connections are switched on), where we only read results and never change anything. Those companies are independent and are not our processors. Customers can disconnect at any time.

Platforms you connect

How do you handle data subject requests?

Customers can export, correct and delete data themselves in Settings. Other requests go to our Grievance Officer and are answered within 30 days, and never later than 90 days under India’s DPDP Rules. We haven’t yet appointed an EU or UK representative under Article 27 GDPR.

Which AI providers process customer content?

OpenAI, Fal and Runway, and the model developers reached through Fal and Runway, such as Google, ByteDance, Kuaishou and ElevenLabs. Tools that let you choose a model show which one will run, every screen that uses a Runway-served model shows “Powered by Runway”, and every model and provider is listed publicly.

AI Models & Providers

Is customer content used to train AI models?

QikTools doesn’t train AI models on customer content, other than private brand models a customer chooses to train. Some providers’ standard terms let them use content they receive to train or improve their models: for example, Runway’s terms (updated 15 September 2026) say inputs and outputs may be used to train its models. Providers whose terms allow this: Runway, ElevenLabs, Kuaishou (Kling AI), Black Forest Labs, Sync Labs (sync.), Creatify and Hyper3D (Deemos). Where a provider lets us switch training off, we do; where it doesn’t, its own terms apply and we have no control over that use.

How AI providers handle your content

How do you label AI-generated content?

Realistic images and videos carry a visible “AI-generated” label. Audio in a cloned voice, and AI speech delivered as audio (for example from AI Voice Studio), starts with a short spoken disclosure; videos with AI speech carry the visible label. Files our servers generate carry IPTC metadata, a unique generation ID and, where the format allows, a signed C2PA Content Credential. AI-written text from our writing tools carries a machine-readable AI mark in copies and downloads (signed where we recognise the text), and we keep a one-way fingerprint of it, never the text, so a pasted text can be checked. Anyone can check a file or a text for free on our verification page.

AI Labels & Content CredentialsCheck a fileCheck a text

How do you stop harmful content?

The text and images in every request that reaches a generative model, and frames and the opening speech of uploaded video and audio, are screened before it runs, by our own rules, a list of public figures and an automated moderation model; tools that only read your own files aren’t screened. Real faces and voices need consent. Reported intimate imagery is disabled straight away and handled within 2 hours, court and government orders within 3 hours, and other unlawful content within 36 hours. Child sexual abuse material is reported to the authorities, and accounts used for it are closed.

Safety measures

Do model providers apply their own safety filters?

Yes, on top of ours. If a request passes our checks but a provider’s own safety system refuses it and charges us for the attempt, the credits shown for that run are charged; otherwise failed runs are refunded automatically.

Provider safety refusals

Do you store payment card data?

No. Plans and credits priced in US dollars are sold by our merchant of record, Dodo Payments, and Stripe handles some team plans; purchases in Indian rupees are sold by us and processed by Razorpay. Card, UPI and bank details go to them, never to us, and their payment notifications are verified with signatures before any credits are added.

Do you hold SOC 2, ISO 27001 or similar certifications?

No. We don’t currently hold SOC 2 or ISO 27001 certification, and we haven’t had an independent penetration test yet. Our database host, Supabase, reports SOC 2 Type 2 compliance. This questionnaire and our Trust Center describe the controls we do have.

Trust Center