Skip to main content

Security and privacy

Chat apps read events from your apps and post them into the room's chat. Qik keeps each connection to exactly that job.

Read-only, always​

Qik never writes back to an app's data. The only change Qik makes in an app is adding — and, when you delete the chat app, removing — the one webhook that connection owns. Sign-in steps ask for the smallest read permission the app offers, and the sign-in card names that permission before you connect.

Keys stay in the vault​

  • Keys and tokens are sealed in Qik's vault. They are never shown to the agent, and never appear in chat or in the agent's run cards.
  • A key only goes to the hosts it was made for. A key for GitHub is only ever sent to GitHub's API, and a key for a custom API only to the hosts recorded when it was made. Every call is checked before anything leaves Qik, so a connector can never borrow your company's key for another address. The sign-in card shows exactly which addresses the key is sent to.
  • The webhook secret is shown only to the room's owners and hosts, in the studio's Delivery tab.

Webhooks are verified​

Each connection has its own private webhook address. When the app signs its webhooks or sends a secret token — as GitHub and GitLab do — Qik checks it before anything posts and refuses deliveries that do not match.

Built only from official docs​

When the agent builds a connector, it reads only public https docs pages and treats them as data, never as instructions. Every event name, signature header and API address in a connector must appear on the docs pages it read. Connectors are data with a small fixed expression language — they contain no code. Outbound calls are limited to public addresses and to reading, plus the connection's own webhook.

People decide what posts​

  • The agent prepares a draft; only a person presses Go live.
  • After Go live, only room owners and hosts switch events on or off.
  • Every member can see which apps post in a room, and mute any app for themselves.

What is kept​

Received events are kept for 30 days so the editor can show counts, previews and the last events; the full event cards behind them are kept for 7 days. Messages posted into the chat are ordinary chat messages and can be deleted like any message.

Company control​

Company owners and admins can switch chat apps off for the whole company, switch off any single app, or allow only listed apps — see Company chats.