SimulQ
Security and privacy

How SimulQ protects your work

Your password is never stored in readable form, card details never reach SimulQ, your files can only be opened by your account, and the site sets no tracking cookie. This page states what is in place, and nothing that is not.

Your account

  • Passwords are never stored as you type them. They are hashed with bcrypt before they are saved.
  • Email accounts must be verified before they can sign in. You can also sign in with Google.
  • Password-reset and verification links are long random codes, stored only in hashed form, and expire after one hour and 24 hours respectively.
  • Sign-in cookies are marked HttpOnly, Secure and SameSite=Lax: page scripts cannot read them, they travel only over HTTPS, and other sites cannot use them.
  • Limits on repeated requests protect password resets, verification emails and questions from abuse.

Payments

Membership and credit purchases are paid on Stripe's own checkout page. Card details are entered there and processed by Stripe; they never pass through or rest on SimulQ's servers.

Your questions, files and results

  • No direct public access to the database. Row-level security is switched on for SimulQ's database tables, and they cannot be read with the database's public access keys; only SimulQ's servers can reach it.
  • Files you attach are kept in private storage. A file can only be fetched by the account that uploaded it; anyone else is told it does not exist.
  • Error reports leave out your content. When something goes wrong, the report SimulQ's engineers receive has IP addresses, cookies, sign-in headers and the body of the request (your question or document) removed.
  • Encrypted in transit. The whole site is served over HTTPS only, and browsers are instructed to refuse any unencrypted connection to it for two years.

The AI models

To answer, SimulQ sends your question and any attached files to the AI providers whose models make up the panel. The Privacy Policy (section 7.6) sets out SimulQ's commitments here:

  • SimulQ uses the providers' developer API tiers, under which your data is not used to train their models.
  • Providers may keep submissions for a limited period, typically 0 to 30 days, for reliability, security and abuse prevention, after which they are deleted.
  • Content that triggers a provider's safety filters may be kept longer, up to two years, under that provider's abuse-prevention rules.
  • Data may be processed outside your home country, primarily in the United States.

No tracking

SimulQ sets no tracking cookie and runs no advertising or third-party tracker. Visits are counted with Vercel Web Analytics, which uses no cookies. The only cookies SimulQ sets are the ones that keep you signed in. Section 13 of the Privacy Policy has the detail.

Reporting a problem

If you believe you have found a security issue, or that your account has been accessed without your permission, email support@simulq.ai.

No method of transmission or storage is completely secure, and SimulQ cannot guarantee absolute security (Privacy Policy, section 14). This page describes the protections in place as of October 2026.