Security
Your Data,
Our Responsibility
Security isn't an afterthought at QuizNap. It's built into every layer of our platform, from infrastructure to application code.
Encryption Everywhere
All data in transit is encrypted with TLS 1.2+. Sensitive data at rest, including integration tokens, is encrypted using AES-256. Passwords are hashed with bcrypt and never stored in plaintext.
Secure Infrastructure
Our platform runs on isolated containers with automatic security patches. Database access is restricted to application services only. Infrastructure is provisioned with infrastructure-as-code for auditability.
Access Controls
Role-based access controls (RBAC) ensure team members can only access what they need. JWT-based authentication with short-lived tokens and secure refresh mechanisms protect user sessions.
Application Security
We follow OWASP Top 10 guidelines. Input validation, CSRF protection, XSS prevention, SQL injection protection, and rate limiting are built into the application layer. Dependencies are regularly audited for vulnerabilities.
Our Security Practices
Regular Security Audits
We conduct regular security reviews of our codebase and infrastructure. Critical dependencies are monitored for known vulnerabilities and patched promptly.
Data Isolation
Organization data is logically isolated at the database level. API endpoints enforce strict authorization checks to prevent cross-tenant data access.
Secure Integrations
Third-party integration tokens (Google, Slack) are encrypted at rest using AES-256 with a dedicated encryption key. OAuth flows use PKCE where supported and tokens are refreshed proactively.
Backup & Recovery
Database backups are performed automatically. Our infrastructure supports rapid recovery to minimize downtime in the event of an incident.
No Data Selling
We never sell your data or your respondents' data. Your content and responses belong to you. See our Privacy Policy for details.
Enterprise Security
For organizations with advanced security requirements, our Enterprise plan includes SSO/SAML authentication, dedicated infrastructure, SLA guarantees, custom data retention policies, and a dedicated security contact.
Contact Security TeamReport a Vulnerability
If you discover a security vulnerability, please report it responsibly to [email protected]. We take all reports seriously and will respond within 48 hours.