Security and privacy | Qritical AI

Signing in

Every account signs in with a passkey, or with a password plus a 6-digit code emailed at each sign-in. Passwords are stored only as salted hashes (bcrypt), never in readable form.

Your secrets and payments

Hugging Face tokens and cloud-storage credentials are encrypted at rest with AES-256-GCM and only decrypted to start your workload. Card payments go through Stripe: we never see or store your card number.

Your workloads

Each workload runs in its own container on a dedicated GPU. Inference endpoints get their own API key, and web apps get an access token or password whenever the app supports one. All traffic to our site and API uses HTTPS. What you install and expose inside a workload is under your control and your responsibility.

Teams

Team roles (owner, admin, member) are enforced by our servers, not just hidden in the interface. Only the team owner can add funds, request refunds, see invoices or delete the team.

Cloud storage connections

Connections to Dropbox, Google Drive and OneDrive are read-only and limited to the folders you choose. We never write to or delete anything in your cloud storage.

Where your data is processed

Qritical is operated by SATO Technologies Corp in Joliette, Québec. Account and billing data are processed in Canada and by service providers that may be outside Québec or Canada, including the United States. GPU workloads run in the data center region shown for each GPU on our pricing page. We don't currently offer a Canada-only processing commitment; contact us if you need one.

Your rights under Québec's Law 25

You can ask to access, correct or delete your personal information, and to withdraw your consent. Write to privacy@qritical.ai, which also reaches the person in charge of the protection of personal information at SATO Technologies Corp. We answer within 30 days. Our Privacy Policy explains what we collect and why.

Report a security issue

Found a vulnerability? Email privacy@qritical.ai with the details. Please don't access other people's data or disrupt the service while testing, and give us reasonable time to fix it before disclosing it.