Security
This page is maintained by QRVault to describe the controls currently enabled in the app. It is not an independent certification.
Authentication
Sign-in is handled by managed auth with Google OAuth and email login. Sessions are stored in secure, HTTP-only mechanisms provided by the auth SDK and rotated on activity.
Authorization & data isolation
Every table uses row-level security. Bundles, files, notes, links, reactions, and analytics are scoped to their owner. Public bundle reads are routed through hardened server functions that never expose password hashes or private files.
Password-protected bundles
Passwords are hashed with bcrypt server-side. Signed URLs for protected content are only issued after server-side verification. Direct object storage access is blocked when a bundle has a password.
Uploads
Uploads run over TLS and use resumable TUS chunks. Files are stored in encrypted object storage with per-bundle quotas (up to 22 GB).
AI features
AI endpoints require a valid session bearer token and verify bundle ownership before processing. AI providers act as processors and do not train on your content.
Reporting a vulnerability
Please email security@qrvault.app with reproduction steps and impact. We aim to acknowledge within 72 hours and coordinate a fix and disclosure timeline with you.