Security at QREATE

You sign in with Discord, with Google, or with an email address and a password. With Discord and Google we never see your password. Where you set a QREATE password we store a one-way hash of it and cannot read it back, and two-factor authentication is available on the account. Access is scoped per server. What the dashboard shows you, and what the API will answer, follows the permissions your Discord account actually has on that server, checked on the server side on every request rather than hidden in the interface. Staff access to a customer's dashboard is a separate, consented, logged session that can be revoked, not an ambient power.

Q runs on Google Cloud (Vertex AI) and Anthropic under their business API terms, and under those terms neither provider trains or improves its models on what we send them: prompts, conversations, server context or images. To make automations and Q work better, our team may review a small, selected sample of conversations and automation runs, with usernames, IDs, links and email addresses removed first. Those excerpts stay with us, are never sold and never go to anyone to train a model. You can opt out at any time, as the privacy policy explains.

Anything that alters a running server is a change somebody approved. The assistant proposes, the person applies, and the card now says what pressing Apply will do before it is pressed: whether members will see something, whether something that already exists is being replaced, whether a role is involved. A server owner can raise how much the assistant does on its own, per server and per kind of action. Deleting never becomes automatic at any level, because Discord has no undo for a deleted channel or role, and a warning nobody reads is not a warning. Copying a scenario from another server is inert until it is switched on. Switching it on goes through a review screen that lists what will be created, what already exists and will be taken over, what your members will see, and what touches roles or credentials. The approval binds to a hash of exactly that list, so editing the scenario or rebinding a channel invalidates an approval a stale browser tab is still holding.

An upload is checked against its own bytes, not against the type it claims to be: a file whose header disagrees with its declared type is refused rather than stored and served under a name it does not answer to. Size, format and per-server limits are enforced on the server. Now the limit, said plainly rather than left for somebody to discover. A file in QAssets gets a stable public address so it can be shown in a Discord embed, which means anybody who has that address can open it. Secrets, identity documents, moderation evidence and anything else confidential do not belong in a QAsset. Archiving a file keeps its bytes. Permanent deletion is the only action that removes them, and it is in Privacy and data along with the rest of the data controls. Copies already cached by Discord or by whoever had the link are outside our reach, and we will not claim otherwise.

Traffic is encrypted in transit. Database access is restricted, service credentials are held outside the application and rotated when they need to be, and the actions that matter leave an audit record that names who did them. Backups exist for disaster recovery: restricted access, normal rotation, and not restored into production except where recovery is genuinely needed. A backup is not an archive we keep forever, and a deletion can leave a residual copy in one until rotation completes, which the Privacy Policy states with its own timescale.

We do not scan every message in every server or inspect every image somebody uploads. It would widen what we process, produce confident false positives, and police communities that asked for none of it. What we do instead: validate uploads technically, enforce limits, review what is published publicly, act on credible reports and provider notices, and keep the ability to quarantine an asset or pause an automation that is doing damage. A report is a reason for a person to look, not a decision. A number of reports never suspends anything on its own.

If you have found something, email [email protected] with "Security" in the subject and enough detail to reproduce it. Please give us a reasonable chance to fix it before telling anybody else, and do not test against a server you do not administer or against other people's data. We will confirm we have it, tell you what we found, and say when it is fixed. If we disagree that it is a problem we will tell you why rather than going quiet.