Security at Quikit

Our security program is guided by the following principles:

• Protect customer information throughout its lifecycle.
• Limit access according to business need.
• Separate customer environments logically.
• Build security into product development.
• Monitor systems for suspicious activity.
• Respond promptly to potential incidents.
• Maintain transparency about our security practices.
• Provide customers with controls to manage their users and data.

Quikit uses a connected, multi-tenant platform architecture in which products share common platform services while customer environments remain logically separated.

Shared platform services may include:

• Authentication.
• Authorization.
• User and role management.
• Workflow execution.
• Notifications.
• File storage.
• Search.
• Audit logging.
• API management.
• AI orchestration.

Logical access controls are designed to prevent one customer from accessing another customer’s information.

Quikit provides identity and access-management capabilities designed to restrict access to authorized users.

Depending on the product and subscription plan, available controls may include:

• Individual user accounts.
• Role-based access control.
• Organization and workspace permissions.
• Administrative roles.
• Password requirements.
• Session-management controls.
• Multi-factor authentication.
• Single sign-on.
• SAML-based authentication.
• User provisioning and deprovisioning.
• API keys and access tokens.
• Audit history.

Customers are responsible for configuring permissions appropriately and removing access when a user no longer requires it.

Quikit uses encryption designed to protect information during transmission and storage.

This may include:

• Transport Layer Security for data transmitted between users and Quikit.
• Encryption of stored customer information where supported by the underlying infrastructure.
• Secure handling of passwords and authentication credentials.
• Protected storage of integration credentials and tokens.
• Controlled management of encryption keys.

Customers should use supported browsers, protect their devices, and avoid transmitting sensitive information through unsecured channels.

Customer workspaces are logically separated through application, identity, and data-access controls.

Access to Customer Content is restricted according to:

• Organization membership.
• User role.
• Workspace permissions.
• Record-level or product-level permissions where supported.
• Authorized support and operational requirements.

Quikit personnel do not receive unrestricted access to Customer Content solely because they work for Quikit.

Security is considered throughout the product-development lifecycle.

Our application-security practices are designed to include:

• Security review during feature development.
• Source-code access restrictions.
• Peer review and change control.
• Dependency and package management.
• Testing before production release.
• Separation of development and production activities.
• Protection of credentials and secrets.
• Input validation and authorization checks.
• Monitoring for unexpected errors and behavior.
• Remediation of identified vulnerabilities according to risk.

No software is entirely free of vulnerabilities. We continually work to identify and reduce security risk.

Quikit uses managed infrastructure and technology providers to host and operate its services.

Infrastructure protections may include:

• Network-level restrictions.
• Firewalls and access-control rules.
• Segmentation of environments.
• Logging and monitoring.
• Availability and performance monitoring.
• Controlled production access.
• Secure configuration management.
• Capacity and resource monitoring.
• Backup and recovery processes.
• Protection against common network threats.

The exact infrastructure used may vary by product, region, customer plan, and deployment arrangement.

Quikit maintains operational and security logs designed to support:

• Authentication monitoring.
• Detection of unauthorized activity.
• Troubleshooting.
• Performance monitoring.
• Incident investigation.
• Administrative visibility.
• Audit requirements.
• Fraud and abuse prevention.

Access to logs is limited to authorized personnel and systems.

Customer-facing audit logs may be available depending on the product and subscription plan.

We use risk-based processes designed to identify, evaluate, prioritize, and remediate vulnerabilities.

These processes may include:

• Dependency review.
• Automated security scanning.
• Code review.
• Configuration review.
• External security assessment.
• Penetration testing.
• Monitoring of relevant vulnerability notifications.
• Remediation based on severity and potential impact.

Security testing is performed only by authorized personnel or approved security providers.

Quikit maintains backup and recovery processes appropriate to the applicable service and infrastructure.

These processes are designed to support recovery from events such as:

• Accidental system failure.
• Infrastructure disruption.
• Data corruption.
• Operational error.
• Security incidents.

Backup frequency, retention, recovery objectives, and restoration availability may vary by plan, product, and customer agreement.

Customers should maintain appropriate exports or independent records where required by their business-continuity, legal, or regulatory obligations.

We maintain operational processes designed to reduce the impact of service interruptions.

Our approach may include:

• Infrastructure monitoring.
• Service-health monitoring.
• Incident escalation.
• Backup and restoration procedures.
• Alternative communication methods.
• Recovery planning.
• Dependencies on multiple authorized technology providers.
• Periodic review of operational risks.

Any contractual uptime commitment, recovery objective, or service-level agreement applies only where it is expressly included in a signed customer agreement.

Quikit maintains procedures designed to identify, investigate, contain, remediate, and recover from security incidents.

Our incident-response process may include:

1. Detection and internal reporting.
2. Assessment and classification.
3. Containment.
4. Investigation.
5. Remediation.
6. Recovery.
7. Customer or regulatory notification where legally or contractually required.
8. Post-incident review and improvement.

Where a confirmed personal-data breach affects Customer Content, Quikit will notify affected customers or individuals as required by applicable law and contractual obligations.

Access to production systems and Customer Content is limited according to role and business need.

Our personnel-security practices are designed to include:

• Confidentiality obligations.
• Role-based system access.
• Access approval processes.
• Security awareness.
• Access removal following role changes or departure.
• Restrictions on production access.
• Internal reporting procedures for suspected incidents.

Background verification may be performed where appropriate, lawful, and relevant to the role.

Quikit works with authorized service providers for areas such as:

• Cloud hosting.
• Authentication.
• Monitoring.
• Communications.
• Payment processing.
• Customer support.
• Analytics.
• AI infrastructure.
• Error reporting.
• Security services.

We evaluate service providers based on factors such as functionality, security, privacy, reliability, and contractual protections.

Service providers are permitted to process information only for authorized purposes and according to applicable agreements.

Customers requiring a detailed subprocessor list may contact Quikit.

Quikit AI features may process prompts, Customer Content, and relevant contextual information to generate outputs or perform authorized actions.

Our AI security approach is designed to include:

• Limiting AI access to information available to the requesting user.
• Applying existing account and workspace permissions.
• Protecting prompts and outputs as Customer Content where appropriate.
• Restricting unauthorized cross-customer access.
• Logging relevant AI activity where supported.
• Evaluating AI features for security and misuse risks.
• Using authorized AI infrastructure providers.
• Providing human review for consequential actions where appropriate.

Customers should avoid submitting information to an AI feature unless they are authorized to process that information.

AI outputs should be reviewed before being used for legal, financial, employment, safety-critical, regulatory, or other significant decisions.

Security is a shared responsibility.

Customers and users should:

• Use unique, strong passwords.
• Enable multi-factor authentication where available.
• Protect devices and email accounts.
• Restrict administrator privileges.
• Review user access regularly.
• Remove inactive users promptly.
• Configure roles and permissions carefully.
• Protect API keys and integration credentials.
• Review connected third-party applications.
• Verify AI-generated outputs.
• Avoid uploading information that is not required.
• Report suspicious activity promptly.
• Maintain independent exports where business continuity requires them.

Quikit is not responsible for incidents caused by compromised customer credentials, insecure customer devices, incorrect permissions, unauthorized integrations, or actions taken by authorized users.

Quikit is committed to improving its security and privacy program in line with applicable laws, contractual requirements, and recognized security principles.

A reference to a security framework does not, by itself, mean that Quikit has been formally audited or certified under that framework.

Quikit will claim a certification, attestation, or independent audit only when it has been validly completed and the claim is supported by current documentation.

Current compliance documents, certifications, penetration-test summaries, or security questionnaires may be made available to eligible customers where available and subject to confidentiality requirements.

Customers with specific regulatory requirements should contact Quikit before purchasing or uploading regulated information.

Unless expressly agreed in writing, customers should not use Quikit to store or process:

• Payment card information requiring direct PCI DSS compliance.
• Protected health information requiring a healthcare-specific agreement.
• Government-classified information.
• Biometric identifiers.
• Highly sensitive identity credentials.
• Children’s personal data without required consent and safeguards.
• Information subject to specialized localization or licensing requirements.
• Any information prohibited by applicable law or the relevant product documentation.

Enterprise customers requiring specialized security, data residency, dedicated infrastructure, or contractual controls should contact our team.

We appreciate reports from security researchers and users who believe they have identified a vulnerability.

To report a potential security issue:

Subject line: Security Report

Please include:

• A clear description of the issue.
• The affected page, product, endpoint, or feature.
• Steps required to reproduce the issue.
• The potential impact.
• Supporting screenshots or evidence.
• Your contact information.
• Whether any customer data was accessed.

Do not:

• Access, modify, download, retain, or disclose information belonging to another user.
• Perform denial-of-service testing.
• Use automated testing that may reduce service availability.
• Attempt social engineering, phishing, or physical attacks.
• Publicly disclose a vulnerability before Quikit has had a reasonable opportunity to investigate and address it.

Submitting a report does not create a contractual relationship or guarantee a financial reward.

For security questionnaires, enterprise reviews, incident inquiries, or vulnerability reports, contact:

Use the subject line “Security Inquiry” or “Security Report.”