Security and Data Protection

URIQA holds unpublished research, client evidence, and technical records. We built it so that this material is encrypted, isolated to your workspace, and visible only to the people you choose.

This page describes the controls in place today. Our legal commitments are set out in the Terms of Use and Privacy Policy.

URIQA's database, sign-in, file storage, and server functions run on Supabase's managed platform, hosted on Amazon Web Services. Supabase maintains a SOC 2 Type 2 report and ISO 27001 certification, and commissions regular independent penetration tests.

The platform we use to build and deploy URIQA is also SOC 2 Type 2 compliant and ISO 27001:2022 certified.

These audits cover the infrastructure our providers operate. URIQA's own application controls are described below.

In transit. Your browser connects to URIQA over HTTPS (TLS). Our servers use TLS for every call to the database, file storage, and AI providers.

At rest. Database records, including notes, findings, plans, drafts, AI conversations, and extracted text, are encrypted at rest with AES-256. Uploaded files are encrypted the same way, and they are stored separately from database records.

Credentials. URIQA never stores your password. The authentication service keeps only a salted, one-way hash. Access tokens for connected accounts such as Google Drive and OneDrive get a second layer of AES-256-GCM encryption. The key for that layer exists only on our servers.

Every project belongs to a workspace, and every table that holds project data enforces row-level security. When the app reads or writes data for you, it does so as your signed-in account. The database checks each row against your workspace before returning or changing it. Isolation is enforced by the database itself, not only by application code.

A few operations need wider access. One example is delivering a project copy that you have approved. These operations run only on our servers, with credentials that never reach a browser.

Files. Uploaded files sit in private storage and never have a public address. Storage enforces the same workspace check as the database: every read, upload, change, or deletion must come from a signed-in owner of the workspace the file belongs to. When you open or download a file, URIQA issues a signed link that expires, usually within minutes and never later than an hour. Until it expires, anyone holding the link can use it, so please don't forward download links.

Sharing. No one else can see a project unless you share it. When you send someone a copy, you review exactly what it will contain before it goes. The recipient gets an independent copy in their own workspace and never gains access to your original.

When you run an AI feature, URIQA sends the content relevant to that request over an encrypted connection to a commercial AI model provider, such as Google or OpenAI. Requests go through URIQA's server-side credentials. Your content is never attached to a personal account with the model provider.

We do not train AI models on your content, and we do not sell your content to anyone.

Model providers process requests under their own commercial terms. URIQA does not currently offer zero-retention processing, a guaranteed processing region, or customer-managed encryption keys. If your work requires any of these, contact us before uploading.

When you connect Google Drive or OneDrive, you sign in on Google's or Microsoft's own page, and URIQA never sees that password. URIQA asks for the narrowest access that works:

• Google Drive: URIQA can open only the files you pick. It cannot see the rest of your Drive.
• OneDrive: read-only access to your own files, not to shared or SharePoint content. Microsoft does not offer a narrower permission.

Disconnecting an account revokes URIQA's access with the provider and deletes the stored token.

Administrative functions require an administrator role. Our servers check that role against the database and never take it on the browser's word.

We do not browse your projects. Authorized personnel access private content only when you ask for help with it, when it is needed to investigate a security issue or abuse, or when the law requires it.

A few habits make the controls above work best:

• Use a unique password, or sign in with Google, and secure the email account connected to URIQA, since sign-in links and resets go there.
• Sign out of shared or public devices.
• Don't forward temporary file links.
• Upload only what a project needs.
• Keep your own copies of records you are required to preserve.

The certifications above belong to our infrastructure providers. URIQA has not yet completed its own independent audit, such as SOC 2 or ISO 27001, and does not hold HIPAA, FedRAMP, CMMC, or similar authorizations.

Unless we have agreed otherwise in writing, don't use URIQA for protected health information, ITAR-controlled technical data, Controlled Unclassified Information, criminal-justice information, payment-card data, or classified material.

If your organization needs a security questionnaire or specific contractual terms, contact support@uriqa.ai. This page describes our practices. It is not a warranty or service-level agreement; the Terms of Use govern.

We want to hear about anything that looks wrong. Email support@uriqa.ai with the subject "Security Report." Describe the affected feature, when you saw it, how to reproduce it, and the potential impact.

While investigating, please don't access other users' information, alter or destroy data, run denial-of-service tests, attempt social engineering, or publish details before we have had a chance to fix the issue. We don't currently run a bug bounty.

If we suspect a security incident, we investigate and contain it. That can mean restricting access, rotating credentials, preserving logs, and working with our infrastructure providers. If an incident affects your information, we will notify you and the relevant authorities as the law requires.