🔒
Security
We use industry-standard infrastructure. Here is exactly what we do and do not store.
🔒 HTTPS only🛡️ RLS enforced🏗️ Vercel + Supabase
Infrastructure
🌐 Hosting
Vercel edge network with DDoS protection
🗄️ Database
Supabase PostgreSQL, encrypted at rest
🔑 Auth
Google OAuth via Supabase Auth
🔐 Data access
Row-Level Security — users see only their own data
Data we store
| Data | Where | Retention |
|---|---|---|
| Email, name | Supabase | Until account deleted |
| Quiz scores | Supabase | Until account deleted |
| Article URLs | Supabase | Until quiz deleted |
| Article text | OpenAI API only | Not stored by QuizOps |
⚡ AI Provider
Quiz questions are generated via OpenAI's API. Your article text is sent to OpenAI for processing only — QuizOps does not store it after generation.
Known Open Issues
We believe in transparency. Current known issues:
- Next.js framework CVEs (14.x) — assessed as low risk given our hosting configuration. Upgrade to Next.js 16 is scheduled.
- No SOC 2 certification yet (planned for Enterprise tier launch)
Responsible disclosure
Found a security issue? Email admin@autoshiftops.com before public disclosure. We aim to respond within 48 hours.
Full source and change history: SECURITY.md on GitHub