Security at Qreate

You sign in with Discord, with Google, or with an email address and a password. With Discord and Google we never see your password. Where you set a Qreate password we cannot read it back, and two-factor authentication is available on the account. Access is scoped per server. What the dashboard shows you, and what the API will answer, follows the permissions your Discord account actually has on that server, checked on the server side on every request rather than hidden in the interface. Staff access to a customer's dashboard is a separate, consented, logged session that can be revoked, not an ambient power.

Q uses commercial AI providers under business terms. Under those terms, providers do not train or improve their models on what we send them: prompts, conversations, server context or images. To make automations and Q work better, our team may review a small, selected sample of conversations and automation runs, with usernames, IDs, links and email addresses removed first. Those excerpts stay with us, are never sold and never go to anyone to train a model. You can opt out at any time, as the privacy policy explains.

Anything that alters a running server is a change somebody approved. The assistant proposes, the person applies, and the card now says what pressing Apply will do before it is pressed: whether members will see something, whether something that already exists is being replaced, whether a role is involved. A server owner can raise how much the assistant does on its own, per server and per kind of action. Deleting never becomes automatic at any level, because Discord has no undo for a deleted channel or role, and a warning nobody reads is not a warning. Copying a scenario from another server is inert until it is switched on. Switching it on goes through a review screen that lists what will be created, what already exists and will be taken over, what your members will see, and what touches roles or credentials. An approval covers exactly what the review screen listed. If the scenario or a channel binding changes afterwards, the approval no longer applies and you review it again.

We check what an upload really is, not only what it claims to be, and refuse files that do not match. Size, format and per-server limits apply. Now the limit, said plainly rather than left for somebody to discover. A file in QAssets gets a stable public address so it can be shown in a Discord embed, which means anybody who has that address can open it. Secrets, identity documents, moderation evidence and anything else confidential do not belong in a QAsset. Archiving a file keeps its bytes. Permanent deletion is the only action that removes them, and it is in Privacy and data along with the rest of the data controls. Copies already cached by Discord or by whoever had the link are outside our reach, and we will not claim otherwise.

Traffic is encrypted in transit. Database access is restricted, service credentials are held outside the application and rotated when they need to be, and the actions that matter leave an audit record that names who did them. Backups exist for disaster recovery: restricted access, normal rotation, and not restored into production except where recovery is genuinely needed. A backup is not an archive we keep forever, and a deletion can leave a residual copy in one until rotation completes, which the Privacy Policy states with its own timescale.

We do not scan every message in every server or classify every direct message sent to the bot. It would widen what we process, produce confident false positives, and police communities that asked for none of it. What we do instead: validate uploads technically, enforce limits, review what is published publicly, act on credible reports and provider notices, and keep the ability to quarantine an asset or pause an automation that is doing damage. A report is a reason for a person to look, not a decision. A number of reports never suspends anything on its own. When a team member records a specific bot DM as a serious safety incident, Qreate preserves the relevant evidence, restricts the sender from the bot and support features, and reports it to Discord.

If you have found something, email [email protected] with "Security" in the subject and enough detail to reproduce it. Please give us a reasonable chance to fix it before telling anybody else, and do not test against a server you do not administer or against other people's data. We will confirm we have it, tell you what we found, and say when it is fixed. If we disagree that it is a problem we will tell you why rather than going quiet.