Security

Background removal

• The image is checked for type and size before anything is done with it, then passed to the model that removes the background. That model runs on a GPU container with no network access of its own and no copy of the file after the request.
• The original and the cutout are written to our disk behind a URL containing a random token, served with Cache-Control: private. There is no listing, and no way to walk from one result to another. That token is the whole of the access control on a signed-out visitor's image, which is why it is random rather than a job number.
• A job running every five minutes deletes both once they are ten minutes old.

Chat with a PDF

• The document is stored, because the tool exists to be come back to. Only pages relevant to your question are sent to the model, and which pages were sent is shown to you.
• Documents are tied to the account or session that uploaded them; another visitor cannot open one by guessing an id.
• Anything the model writes is inserted as text, never as HTML. A file that tries to smuggle a script through a page of text cannot get one to run in your browser.

In neither case does anyone here open your file. There is no review queue, no support tool that shows an upload, and no export of them.

• HTTPS everywhere. Plain HTTP is redirected, and HSTS is set for a year with subdomains included, so a browser that has seen this site once will not try HTTP again.
• Session and CSRF cookies are marked secure, so they are never sent over an unencrypted connection.
• The site refuses to be framed, refuses content-type sniffing, and sends referrers to other sites with the path stripped.
• Stored files, the database and its backups sit on managed AWS services with encryption at rest; credentials live in the environment, never in the code or the repository.

• Passwords are hashed with Django's default PBKDF2 with a per-user salt. The password itself is never written down, and a database dump would not reveal it.
• Sessions live in our cache rather than the cookie; the cookie holds a key and nothing else.
• Signing in with Google means we never handle your Google password at all.
• Email addresses are verified before an account is fully usable, and password resets expire.
• Sign-in and registration are rate limited, so a stolen password list cannot be tried against the site at speed.

A request-protection layer sits in front of the whole site, watching for the traffic shapes that precede a bad afternoon: bursts far above human speed, scripted signups, scanning for admin paths.

• Allowances are counted per account for signed-in visitors and per address for everyone else, so clearing cookies does not reset anything an account holds.
• Burst limits sit above every plan's allowance, never below it, so a guard cannot refuse something a plan was sold on.
• A paying subscriber who trips a limit is slowed down, not blocked. A block here does not expire on its own, and applying one to a customer would turn a busy minute into an outage lasting until a person cleared it.

Two features take an address from a visitor, and an address from a stranger is how a server gets turned into a fetching tool for whatever its network can reach — the cloud metadata service included.

• Our image proxy will fetch from our own storage and nothing else.
• Webpage to Markdown refuses private and internal addresses, re-checks every redirect it follows, caps how much it will download and how long it will wait, and sends no cookies.
• The HTML that comes back is parsed, never rendered. No script in it runs, nothing it references is fetched, and only text comes out the other side.

Paddle is the merchant of record and runs the checkout on its own pages. No part of a card number reaches our servers, so there is nothing here for a breach of this site to expose. What we store is the amount, the date, the invoice number and which plan you are on.

This page carried an ISO 27001 badge and a SOC 2 report date until August 2026. Neither was real. Everything below is a control this site does not have, listed because you need it to decide what to upload:

• No ISO 27001, SOC 2 or PCI DSS certification. No auditor has examined this site. If your procurement process needs one of those, we are not a fit yet.
• No third-party penetration test and no round-the-clock security operations centre.
• No two-factor sign-in yet. Use a unique password, or sign in with Google and let Google's second factor do the work.
• No malware scanning of uploads. Uploads are validated by type and size. Nothing is executed, opened or previewed on our side, so a hostile file has nothing to attack — but it is not scanned, and we will not say it is.
• No end-to-end encryption for the two tools that upload. Files are encrypted in transit and at rest, but they are readable by the service that processes them, which is what makes processing possible.
• No paid bug bounty. Reports are welcome and credited; there is no money behind it.

Some of these will change, and this list is where that will show up first. It will never be quietly shortened.

Write to security@qikkstools.com with what you found, how to reproduce it, and what it lets you do. You will get a human reply, and we will tell you when it is fixed.

Test against your own account and your own files. Do not run automated scanners against the site, do not degrade the service for anyone else, and do not read, keep or publish another person's data — stop at proof that you could. Report it to us before telling anyone else, and give us a reasonable window to fix it.

Stay inside those lines and we will not pursue any legal claim against you for the research, and we will credit you if you want the credit.

Every service behind these tools is checked every five minutes, and each check is published on the status page — including the failures, and including the days nobody checked, which are drawn grey rather than green.

If personal data is ever exposed, we will tell the people affected directly and say what happened, what was reachable, and what we changed. Where the law sets a deadline for telling a regulator — 72 hours under the GDPR — we will meet it. There will be no announcement that an incident was "contained" without saying what it was.