Security

Your customers' data, handled with care

Support conversations and feedback hold personal data. Here is where Quackback keeps it, how it's protected, and how you stay in control of it.

Questions for a security review?

14-day Pro trial, no card needed
Keep using it free if you don't upgrade
Open source. Self-host with Docker

Start free trial Email security@quackback.io

Hosted in the EU

Quackback Cloud runs in the Netherlands. Everything that stores your workspace's data stays in the EU.

Application and databaseRailway, Netherlands (europe-west4).

Files and backupsStored in Amsterdam. Postgres is backed up continuously, so it can be restored to a point in time.

EmailSent through Amazon SES in Ireland, signed with DKIM and aligned with SPF and DMARC.

Quackback AIRequests go through OpenRouter to the model provider that runs them, such as OpenAI.

Website and inbound emailCloudflare serves this site and routes inbound email.

Your own serversSelf-host the same code anywhere you like, with your own AI provider.

Control who gets in

Sign-in and access controls for your team, with a record of what changed.

Single sign-onOIDC with Okta, Microsoft Entra, Auth0, Keycloak and more. Require it for your team, with recovery codes. On Enterprise, or any self-hosted install.

Two-factor sign-inTeammates can protect their accounts with an authenticator app.

New-device alertsTeammates get an email when their account signs in from a new device.

RolesAdmin, member and custom roles, with custom roles from Business.

Audit logWho changed what and when, kept for a year by default. On Enterprise.

Scoped API keysKeys carry only the access you give them, and rotate or revoke at once.

Protected in the product

Safeguards built into how Quackback stores data, talks to other systems and runs AI.

Encrypted secretsIntegration tokens and other secrets are encrypted with AES-256-GCM before they are stored.

Encrypted in transitEvery page, API call and widget request uses HTTPS.

Signed webhooksEach delivery carries an HMAC-SHA256 signature, so you can check it came from Quackback.

Careful with untrusted textText from customers is marked as untrusted when AI tools and MCP clients read it, and Quackback AI treats it as content, never as instructions.

Settings changes you can traceCopilot proposes settings changes, and nothing changes until a teammate applies it, with undo. MCP clients need a key with the write:settings scope, and every change returns a before-and-after receipt.

Verified sendersInbound email that fails sender checks is flagged in the inbox, so your team knows when a sender can't be trusted.

Open source, so you can check

Quackback is open source under AGPL-3.0. Your security team can read every line, and Cloud runs the same code.

Read the codeEvery module is public on GitHub, with one image and no closed edition.

Self-host itRun Quackback on your own infrastructure, inside your own compliance program.

Telemetry you can turn offSelf-hosted installs send one anonymous ping a day. Set DISABLE_TELEMETRY=true to stop it.

Security questions

Where is my data stored?

Quackback Cloud runs on Railway in the Netherlands (europe-west4), with file storage and backups in Amsterdam. Email is sent through Amazon SES in Ireland. When you use Quackback AI, the content it works on is sent through OpenRouter to the model provider that runs the request, such as OpenAI. Self-host Quackback to keep everything on servers you choose.

Is Quackback SOC 2 certified?

Not yet. If you need a certified environment today, self-host Quackback inside your own compliance program. The code is open source, so your security team can review all of it.

Do you offer a data processing agreement?

Email sales@quackback.io and we'll work through a data processing agreement with you, including the subprocessors we use.

How do I report a vulnerability?

Email security@quackback.io with the details and steps to reproduce. Please give us a reasonable time to fix the issue before you disclose it publicly. We'll confirm we've received your report and keep you updated.

Can I enforce single sign-on?

Yes. On Enterprise, or on any self-hosted install, connect an OIDC provider such as Okta, Microsoft Entra, Auth0 or Keycloak and require it for your team, with recovery codes for emergencies. Quackback doesn't support SAML.

What happens to my data if I leave?

You can pull your data through the REST API on every plan, or download a full workspace export on Business and up. When you delete your account, we remove your personal data within 30 days, and it leaves our backups as they expire.

Have another question? Talk to the team.

Try Quackback with your own data

Start free trial Contact sales