Security controls and their limits

The application supports password authentication, configured OAuth login, session revocation, logout from all devices, and authenticator-app multi-factor authentication. Protect your account credentials and use available security settings.

Platform-wide administration requires both an administrator role and an email in the deployment's platform-admin allowlist. The standard administrator user view is limited to email, account status, roles, and multi-factor status. It omits per-user document, query, conversation, and recent-activity counts. Workspace views show status and seats; aggregate analytics use a minimum group threshold.

Content access is separately assigned for support, feedback, and moderation. Support Managers can read support ticket content and attachments across workspaces and must also be in the platform-admin allowlist. Feedback Managers can read feedback text across workspaces, with submitter email and account IDs omitted from their staff response. Qel Connect moderators can read report details only in their assigned workspace. Staff reads and administrative changes are audited. Users should not assume that all content is invisible to authorized staff.

Protected requests are checked against tenant, account ownership, role, and resource permissions. Provider credentials are handled by backend services and are not meant to be returned in normal product responses. Their protection depends on the configured encryption keys and deployment practices.

This is a server-side application. When you request an AI, search, embedding, reranking, voice, email, or connected MCP action, required information may be processed by the configured service. Use only connections appropriate for the information you send.

AverQel does not provide end-to-end encryption for the entire product. Qel Connect has limited client-side encryption features, but document processing and other service operations may require server access to content. Security also depends on deployment configuration, patching, monitoring, network boundaries, key protection, backups, and incident response.

Use Support Centre in the application to report a suspected issue. Do not include passwords, API keys, recovery codes, or unrelated user content. Support content is readable by assigned Support Managers and is not end-to-end encrypted. The hosted service is operated by Ravinder Singh — Independent Developer, AverQel Independent Project. The current source does not specify a public security contact for people who cannot sign in.