Platform and workspace roles
Platform administration is restricted to an approved superadmin account. Workspace members receive their workspace role and permissions. Hiding a button is not our only access control: protected server routes and database rules also enforce access.
Workspace data
Workspace-scoped queries and row-level database policies restrict shared data to authorized members. Users can update ordinary profile details; protected account status and platform-role fields are controlled by authorized server operations.
Sessions and connected services
Authentication uses verified sessions and cookies. Research providers, email connections and payments have their own availability and access requirements. Protect connected-account credentials and use unique passwords.
Responsible disclosure
Report suspected vulnerabilities to support@qrolia.com. Use accounts you own, avoid accessing personal data and stop testing if there is any risk of disruption. We do not claim SOC 2 certification, ISO certification or a bug-bounty reward program.