Last updated: August 21, 2026
All traffic uses HTTPS. Your document text, conversation history, and study sets are encrypted at the application layer before they ever reach the database, with the encryption key held separately from the data. Original uploaded files are never stored - only the extracted text is kept, encrypted.
Every account's data is isolated: all document operations require authentication, and no request can read another user's content. Optional two-factor authentication (authenticator app) is available on the profile page. Every uploaded file is scanned for malware before it enters your library, and rate limits plus daily usage caps bound what any single account or IP can do.
You can review active sessions and revoke them, download everything we hold about you, and delete your account and all its data yourself, no support ticket required. The third-party services that process data on our behalf, and exactly what each one receives, are listed on the subprocessors page. How we handle your data more broadly is covered in the Privacy Policy.
If you believe you have found a security vulnerability in Querent, we want to hear about it. Email security@querentapp.com with a description of the issue, the steps to reproduce it, and any relevant URLs or request details. This address is also published in our security.txt.
We will acknowledge your report within 3 business days, keep you informed as we investigate, and credit you (if you would like) once the issue is resolved. We do not currently run a paid bug bounty program.
We will not pursue legal action against anyone who researches and reports a vulnerability in good faith. Good faith means: use your own test account rather than accessing anyone else's data; if you stumble onto another user's data, stop, don't save it, and tell us; don't degrade the service for others (no denial-of-service or volumetric testing); don't use social engineering, phishing, or physical attacks; and give us a reasonable window to fix the issue before disclosing it publicly.
In scope: www.querentapp.com, api.querentapp.com, and the Querent Web Clipper browser extensions. Out of scope: our third-party providers' own infrastructure (report issues there to the provider - they are listed on the subprocessors page), findings that require a stolen device or credentials, and reports from automated scanners without a demonstrated impact.