How we keep QoBot and your data safe
We build an AI CISO, so our own security is the first thing you should check. Here is what we do today, and how to report a vulnerability.
Your data stays on your computer
The desktop app keeps your security workspace in a folder on your machine, with its full history. Nothing leaves it without your OK, apart from the calls to your own AI provider.
Hosted in France
Our API, its database and this site run on OVHcloud in Paris, encrypted in transit and at rest. Our providers are listed in Subprocessors.
Least privilege
Each service account has only the rights it needs. API keys are hashed at rest, scoped, revocable and rate-limited.
No third-party code by default
This site loads scripts and styles from qobot.io only, under a strict Content Security Policy. No tag manager. An ad tag loads only after you accept it.
No content in our logs
Logs and telemetry never contain conversation content. The app's telemetry follows your settings, and you can turn it off.
You approve every action
In the app, anything with an effect outside it (network, deleting files, sending) waits for your approval. Instructions found in documents never run without your confirmation.
The desktop app
- Built on Electron with its protections on: context isolation, sandboxed renderer, no Node.js in the interface, a strict Content Security Policy, no remote code, and only validated messages between the interface and the core.
- Your AI provider’s API key is stored in your operating system’s keychain, never in the workspace or in logs.
- The app installs updates by itself only when the build is signed. Until signing is in place on a platform, the app tells you a new version exists and points you to the download page.
- Workspace files, questionnaires and web pages are treated as untrusted input: what they contain can’t trigger an action without you.
Our servers
- Hosted on OVHcloud, Paris region, with encryption in transit and at rest.
- Logs record the method, route and status of each request: no request body, no IP address. Rate limits use a hash of the IP, kept 24 hours.
- Product telemetry reaches PostHog EU only through our own endpoint, which enforces your telemetry level and drops your IP.
- Backups are tested.
How we work
- Multi-factor authentication is required for everyone in our GitHub organization. The main branch is protected: every change goes through a pull request and green automated checks.
- Secret scanning with push protection and dependency alerts are on.
- No plaintext secret in our code, ever. Secrets are encrypted with SOPS, with one key per person and a production key held only by our deployment pipeline.
Your questionnaire
Need our answers for your own security questionnaire? Write to security@qobot.io.
Vulnerability disclosure
We welcome reports from security researchers. If you think you found a vulnerability in qobot.io, api.qobot.io or the QoBot desktop app, write to security@qobot.io with what you found, the steps to reproduce it and its likely impact. English or French. Our contact details are also in /.well-known/security.txt.
What we commit to
- acknowledge your report within 2 business days;
- keep you informed until it’s fixed;
- credit you publicly once it’s fixed, if you wish;
- take no legal action against research done in good faith within these rules.
What we ask of you
- test only your own accounts and data; stop and tell us as soon as you reach someone else’s data, and don’t keep it;
- no denial of service, spam, social engineering or physical attacks, and no testing of our providers’ systems (OVHcloud, Resend, PostHog…);
- give us reasonable time to fix the issue (90 days unless we agree otherwise) before you disclose it.
We don’t run a paid bug bounty yet.