Security at Quad Build

Quad Build is an AI app builder, which means we handle two things that matter: your account, and the code and data of every project you build. Our security posture is built on a small number of reputable infrastructure providers, least-privilege access, and isolation between projects.

• Convex hosts our application database, file storage, and backend functions, with transactional integrity and encrypted storage.
• Vercel serves this site and powers the isolated sandboxes used for live project previews.
• WorkOS AuthKit handles authentication, including secure session management and support for SSO on enterprise identity providers.

Sign-in is delegated to WorkOS AuthKit. We never see or store your password. Sessions are short-lived and transported over TLS. You can sign out of all sessions at any time from your account settings.

Project files are stored per-project and are not shared between users. Public project pages exist only when you explicitly publish a project; everything else requires authentication. Previews run in isolated sandboxes that are torn down after use, and checkpoints are stored as snapshots so your work can be restored.

When you connect GitHub, Vercel, or Supabase, you grant scoped OAuth access on your own accounts. We request the minimum scopes needed to push code, create deployments, or wire a database, and you can revoke access at any time from the provider’s dashboard or from your connectors settings. Deployments, repositories, and databases live in your accounts under your control.

Subscriptions and usage-based billing are processed by Polar. Card details go directly to Polar and never touch our systems — we only receive a customer reference and subscription state.

Prompts, attachments, and project context are transmitted over encrypted connections to the AI model providers we work with, under agreements that prohibit training on your content. We do not sell your data or use your project content for advertising.

We welcome responsible disclosure. Email security@quad.chat with details and, if possible, steps to reproduce. We will acknowledge your report promptly, keep the discussion confidential, and credit you if you would like. Please do not test against other users’ projects or data.

Operational updates and incident notes are posted to the changelog. If a security incident affects you or your data, we will notify affected users directly and without undue delay, as required by applicable law.