Access control
Qwik follows least-privilege principles for administrative and production access. Access to sensitive systems and protected platform data is limited to personnel with a legitimate operational need and is reviewed as roles or responsibilities change.
Authentication and credentials
Platform secrets, access tokens, refresh tokens, and application credentials are treated as sensitive credentials. They are not intended to be exposed in public client-side code, shared in support messages, or logged in plaintext. Production integrations should use server-side credential handling and authorization-state validation.
Data protection
Qwik is designed to use secure transport for data in transit and appropriate safeguards for stored data. We separate public website content from production application systems and limit data collection to information needed for product functionality, security, support, and legal obligations.
Monitoring and incident response
We maintain logging and operational monitoring appropriate to the service and investigate suspected unauthorized access, credential exposure, abuse, or material service anomalies. Confirmed incidents are escalated under our incident-response process, including containment, remediation, evidence preservation, and required notification.
Vulnerability management
Security updates and dependency issues are reviewed as part of software maintenance. High-risk findings are prioritized based on exploitability, exposure, and potential impact. Qwik does not authorize third-party penetration testing or automated scanning of production systems without written permission.
Data lifecycle
Protected data is retained only for legitimate service, security, and legal purposes. When an authorization is revoked or data is no longer required, Qwik applies its documented deletion and retention process. See our Data Deletion page.
Service providers
Vendors that may process service data on our behalf are evaluated according to the sensitivity of the data and the role they perform. We do not permit service providers to use protected platform data for independent advertising or data-brokerage purposes.
Report a security issue
If you believe you found a security issue affecting Qwik, email security@heyqwik.com with a description, steps to reproduce, affected URL or feature, and your contact information. Do not include live access tokens, passwords, or unnecessary personal data.