Security
How Qubax AI handles credentials, payments, and data. This page states only practices that are implemented today — the same facts as our privacy policy.
Credentials & API keys
Passwords are hashed with argon2id and never stored in plain text. API keys are stored as SHA-256 hashes — Qubax cannot recover or view your full key after creation, so store it securely when you generate it. Sessions are token-based with expiration, and the session cookie is httpOnly.
Transport security
All connections are served over HTTPS, with HSTS enabled and strict Content-Security-Policy headers (nonce-based script execution) across the site and API.
Crypto payments
Cryptocurrency payments are processed by NOWPayments, a third-party payment processor. Qubax never stores private keys or wallet seed phrases. Payment records consist of NOWPayments transaction IDs. Deposits and withdrawals are recorded on public blockchains and are independently verifiable.
Data collection & retention
Qubax collects the minimum needed to operate: email or wallet address for sign-in, conversation history, API usage data (tokens, costs, timestamps), and payment records. Data is not sold and not shared with advertisers. Prompts are sent to upstream AI providers to generate responses — that is the only external data flow. You can export or permanently delete your account and data at any time.
Cookies
One essential session cookie is used for authentication. No tracking or advertising cookies are used.
Infrastructure
The platform runs on containerized services with automated daily backups that are restore-tested, a real-time public status page covering API health and uptime, and automatic seller failover so an unhealthy upstream cannot take a model offline.
Responsible disclosure
Found a security issue? Report it to t.me/QubaxAiChat or @Qubax_Ai. Reports are reviewed and fixed promptly; we credit reporters who want to be named.