Security & Encryption Standards
How Quiver Technologies protects your agency data, API credentials, and client intelligence with defense-in-depth cryptography and architectural tenant isolation.
1. Security Philosophy
At Quiver, security is not an afterthought or compliance checkbox — it is the fundamental foundation of our architecture. We operate on the principle of Zero Trust, ensuring that every layer of the application validates identity, encrypts secrets, and prevents unauthorized cross-tenant data access.
2. AES-256-GCM Cryptographic Key Vault
When you configure custom LLM API keys (Anthropic, OpenAI, OpenRouter, GLM, NVIDIA NIM) in Quiver, they are never written to disk or database tables in plaintext.
Cryptographic Specification
- • Algorithm: AES-256-GCM (Galois/Counter Mode with 128-bit authentication tag).
- • Initialization Vectors: Unique 96-bit cryptographically secure random IV per secret.
- • Key Derivation: Secrets are isolated using master encryption keys held securely in protected runtime environments.
- • Redaction on Retrieval: When keys are retrieved for frontend UI display, they are strictly masked to
••••••••.
3. Multi-Tenancy & Row-Level Security (RLS)
Quiver enforces strict data isolation using native PostgreSQL Row-Level Security (RLS) policies on every table in our database.
- Database-Enforced Boundaries: Even in the event of an application logic bug, the database engine itself rejects any query attempting to read or write rows belonging to a different
user_idororganization_id. - RBAC Role Verification: Team roles (Owner, Admin, Writer, Reviewer, Viewer) are checked at both middleware and database transaction boundaries.
4. Encryption in Transit & Network Security
- TLS 1.3: All traffic between user browsers, edge servers, and our database is encrypted with modern TLS 1.3 with Perfect Forward Secrecy.
- HSTS: Strict HTTP Strict Transport Security is enforced with preloading.
- DDoS & WAF: Edge proxy layers filter malicious traffic, automated scrapers, and volumetric layer-7 attacks.
5. Zero-Retention AI API Isolation
Our connections to artificial intelligence engines (Anthropic, OpenAI, OpenRouter) utilize enterprise-grade API endpoints. Under these agreements:
- No customer prompts or capability profiles are retained or logged by foundation model providers.
- No customer data is ever used to train, retrain, or improve public AI models.
- Completions are streamed directly over ephemeral TLS sockets.
6. Authentication & Session Security
- HTTP-Only Secure Cookies: Session JWTs are stored in
HttpOnly,Secure, andSameSite=Laxcookies, preventing JavaScript access and neutralizing Cross-Site Scripting (XSS) attack vectors. - Bcrypt Password Hashing: Passwords are cryptographically salted and hashed using adaptive bcrypt algorithms.
- CSRF & Replay Protection: All mutating API routes validate anti-forgery headers and authentication origins.
7. Vulnerability Management & Responsible Disclosure
We welcome collaboration with independent security researchers. If you discover a potential vulnerability, please report it responsibly:
Responsible Disclosure Inquiries
Email: security@quiver.app
Response SLA: Initial acknowledgement within 24 hours
Please include reproduction steps and proof-of-concept payloads.
8. Disaster Recovery & Business Continuity
Our databases feature continuous point-in-time recovery (PITR) backups with automated geo-replication across independent availability zones. In the event of a regional cloud outage, services can be restored with a Recovery Time Objective (RTO) of under 2 hours and Recovery Point Objective (RPO) of under 5 minutes.