Security

Where your data lives, in plain words.

Written for the person filling in the security questionnaire. This page says what quibbit does with each kind of data. It does not claim a certification. Last reviewed 2026-10-10.

Where your data lives

DataFree, Solo, and TeamEnterprise

Video, screenshots, HAR, and traces of a passing runFree, Solo, and TeamNot kept. Video records to a temporary local file and is deleted when the run passes. The step log stays, and it can redraw the cursor.EnterpriseSame, or keep passing runs for a number of days you set, for audits.

Evidence of a failureFree, Solo, and TeamOn the QA's machine. Uploaded only when someone shares it, and masked first.EnterpriseOur storage in the US, or your own Amazon S3 bucket through a role you can revoke.

Prompts and model responsesFree, Solo, and TeamNever on our servers, in our telemetry, or in our traces. They go from the machine to the provider or gateway you pick, and they carry page content and screenshots to that endpoint.EnterpriseSame, through the endpoint your admin sets for everyone.

Model keysFree, Solo, and TeamThe OS keychain on each machine: Keychain on macOS, Credential Manager on Windows.EnterpriseOr the admin's endpoint, so members hold no key at all.

Test accountsFree, Solo, and TeamA local vault on Free and Solo. A team vault on Team, encrypted with a per-workspace key before it is stored.EnterpriseSame. An end-to-end encrypted vault is planned.

Finding titles, run metadata, membershipFree, Solo, and TeamOur database, in the US.EnterpriseSame, with retention you set.

Audit logFree, Solo, and TeamNone.EnterpriseKept by us, streamed to your SIEM or your bucket.

Hosted runnersFree, Solo, and TeamA browser we rent sees your pages and the test logins the run uses. It's destroyed when the session ends. Off by default.EnterpriseSame, or a runner pool in your own cloud, so pages never leave your network.

What sharing strips

Before any evidence leaves the machine, video and screenshots are masked, and HAR files, traces, URLs, and logs lose cookies, auth headers, tokens, and filled-in form values. The masking runs on the machine, before upload.

Encryption

In transit: TLS 1.2 or newer between the app, our services, and storage. Model calls use the provider's own TLS.
At rest: Shared evidence and database rows are encrypted at rest.
Vault: Team vault secrets are encrypted with a per-workspace key before they are stored. Local vault secrets never leave the machine.
Keys: Model keys live in the OS keychain. Share links and bucket uploads use short-lived signed URLs.

Access

Your people: Owner, Admin, Member, Viewer, and Billing. Pen tests run only on verified domains, after approval from an Admin or a member they allow.
Share links: 7 days on Free. On Solo and Team, as long as the evidence is kept (30 days on Solo, 90 days on Team). An Admin can revoke any link.
Your bucket: We assume a role you create, with a per-customer external ID, limited to one prefix. Revoke the role and we can't start new uploads. Upload links already issued expire within 15 minutes.

Ask us

Need more than this page?

The security packet has the full list of who processes your data, our answers to the common questionnaires, and the DPA.

Talk to our security teamsecurity@quibbit.ai

How a model call flows

The app on each machine calls the model endpoint directly. quibbit's servers are not on that path and cannot see what is sent.

Your machine

quibbit app and browsers

Builds the prompt from the page, screenshots, and the step so far. Holds the key in the OS keychain. Records evidence locally.

TLS, directprompt, page content, screenshots

Your provider or gateway

Anthropic, Bedrock, Vertex, or yours

LiteLLM, Portkey, Azure APIM, or an in-house endpoint. Their data terms apply to what they receive.

Not in the path: quibbit's servers

They receive finding titles, run metadata, and membership. Never prompts, model responses, or keys. Not in telemetry, not in traces.

Report a vulnerability

If you find something, tell us before you tell anyone else. We keep you posted while we fix it, and credit you in the release note if you want.

Emailsecurity@quibbit.ai

Test only against workspaces and sites you own. Never against another customer's.
Include the version, the steps, and what you expected. A run share link is ideal.