What We Collect
Contact inquiries and job applications — names, emails, resumes, and whatever you choose to write to us. We collect no payment data, run no ads, and use no third-party trackers or analytics scripts.
Security
Security, stated plainly.
We build AI systems that can show their work, and we hold our own infrastructure to the same standard. This page describes what we actually do — in plain language, claiming nothing we cannot demonstrate.
How We Handle Your Data
Where It Lives
Form submissions are stored in a managed Postgres database and relayed to us by email. Everything moves over TLS — the site enforces HTTPS with HSTS — and storage is encrypted at rest by our infrastructure providers.
Who Sees It
A small team, on a need-to-know basis. Voluntary self-identification answers from job applicants are stored in a separate table that applicant review never touches, and are not used in hiring decisions.
How This Site Is Built
Each of these is implemented in this site's codebase — not aspiration, current behavior.
- Every form field is validated and sanitized server-side; single-line inputs are stripped of control characters to block email header injection.
- Resume uploads are restricted by file type and size, and stored as inert binary data.
- Spam is filtered with honeypots, not CAPTCHAs — we don’t make people prove they’re human to reach us.
- Secrets live in environment configuration, never in the codebase.
- The site runs on serverless infrastructure — no long-lived servers of our own to leave unpatched.
Found a vulnerability?
If you discover a security issue in quitosai.com or any Quitos AI product, we want to hear about it directly — before anyone else does.
Responsible Disclosure dev@quitosai.com
- Include steps to reproduce. We acknowledge reports within two business days.
- Good-faith research is welcome: don't access data that isn't yours, don't degrade the service, and give us reasonable time to fix before disclosing publicly.
- We will not pursue action against good-faith security research.
What We Don't Claim
We do not yet hold formal certifications such as SOC 2 or ISO 27001. When we do, this page will say so. We would rather tell you exactly where we are than imply more — that is the standard we apply to our products, and it applies here too.