Security at QuillAI
QuillAI is a pure AI application. Here is how we protect your inputs, uploaded files and account data – at every layer of the stack.
TLS / SSL Encryption in Transit
Every single connection to QuillAI – sign-in, chat, file upload, the AI request – runs exclusively over HTTPS with modern TLS encryption (TLS 1.2 / 1.3). Prompts, uploaded PDFs/DOCX/TXT/CSV and images are transmitted encrypted between your browser, our edge server and the AI provider.
There are no unencrypted HTTP endpoints. Cookies are set with the Secure and HttpOnly flags.
Server-Side Secrets (API Keys)
The key for our AI provider (LOVABLE_API_KEY for the Lovable AI Gateway, which calls the Google Gemini models) is used exclusively server-side inside protected edge functions / server functions. It is never bundled into the frontend, never exposed in the browser, and never visible to third parties in HTML, JS or network requests.
PayPal credentials and the database service-role key are likewise stored exclusively as server secrets and are not reachable from the browser.
Client / Server Separation
AI calls, payment webhooks and all database writes run inside server-side functions. The browser only receives a public, restricted database key (publishable key) and is forced by Row-Level-Security (RLS) to access only its own data.
Row-Level Security & Data Isolation
Every database row is bound to your user ID via RLS policies. Another user fundamentally cannot read, copy or modify your chat history or subscription – not even by hand-crafting requests.
AI Provider & No Training
We process your inputs through the Lovable AI Gateway, which calls Google Gemini models. Per the official API policies, content sent through the API is NOT used to train new AI models.
Shared Responsibility
This page is maintained by the app owner and describes enabled technical controls. It is not an independent certification or audit report. You are responsible for using a strong password, securing your device and using the AI lawfully.