thinQit|Security
|
Six pillars of trust
How thinQit protects your work.
thinQit encrypts stored credentials with AES-256-GCM, checks every request against your workspace, logs significant actions, lets people decide which AI work goes live, and runs on Microsoft Azure in West Europe.
Encrypted credentials
Never stored as plain text
Connected logins, OAuth tokens and API keys are encrypted with AES-256-GCM before they are stored, with a separate key for each purpose. Passwords are hashed with scrypt.
- AES-256-GCM for stored credentials
- A separate key for each purpose
- Passwords hashed with scrypt
- Encryption keys kept out of the code
Workspace isolation
Your data stays in your workspace
Every request is checked against your session, your workspace and your active membership before any data is read or changed. Admin, manager and member roles decide who can change what.
- Session checked on every request
- Data scoped to your workspace
- Admin, manager and member roles
- Project access granted per person
Privacy
A Dutch company under the GDPR
Thinqit B.V. is registered in the Netherlands and processes personal data under the GDPR. Card details are entered with our payment provider and never reach thinQit's servers. Read the privacy policy.
- Personal data handled under the GDPR
- DPA available on request
- Account deletion on request
- Card payments handled by a certified payment provider
Audit trail
Significant actions, logged
thinQit writes significant actions to an audit log, such as billing events, agent access and changes to what an agent may do, together with the workspace, the time and the result.
- Billing events
- Agent access
- Changes to agent permissions
- Time and result of every entry
Human review
You approve the work
Cody hands you code changes as pull requests to review. Sam waits for your approval before a post goes out, and Robert reads your reporting sources without changing them.
- Code changes as pull requests
- Posts wait for your approval
- Read-only reporting connections
- Search Console read-only by default
Secure delivery
Checked before every release
The app and its database run on Microsoft Azure in the West Europe region, in the Netherlands, and are served only over HTTPS, with HSTS and strict security headers. Every release runs a secret scan and a dependency audit, and a high or critical advisory blocks it until it is reviewed.
- Microsoft Azure, West Europe region
- HTTPS only, with HSTS
- Secret scan on every release
- Dependency audit on every release
Security FAQ
thinQit security, answered
Direct answers about encryption, access, auditing and data location.
How does thinQit encrypt customer data?
Connected logins, OAuth tokens and API keys are encrypted with AES-256-GCM before they are stored, with a separate key for each purpose. Passwords are hashed with scrypt, all traffic uses HTTPS with HSTS, and card details are entered at Stripe and never reach thinQit's servers.
Does thinQit follow the GDPR?
Yes. Thinqit B.V. is a Dutch company and processes personal data under the GDPR. A DPA can be requested from legal@thinqit.io, and you can ask us to delete your account at any time.
How is access to a workspace controlled?
Every request is checked against your session, your workspace and your active membership before data is read or changed. Workspaces have admin, manager and member roles: only admins change integrations and workspace privileges, and admins and managers grant project access.
How do people stay in control of AI work?
Cody hands you code changes as pull requests to review, Sam waits for your approval before a post is published, and Robert reads your reporting sources without changing them. thinQit also records significant actions, such as agent access and billing events, in an audit log.
Where is thinQit data stored and processed?
The thinQit app and its database run on Microsoft Azure in the West Europe region, in the Netherlands. Every release runs a secret scan and a dependency audit before it goes live.
Explore related thinQit pages
Security you can show, not just claim.
Ask us anything.
Request a DPA or send your security questions to our team.
Talk to security