On this page
Effective date: October 21, 2026
Document version: 3.0
Read together with our Privacy Policy and GDPR and DPA page.
1. Our approach
This page describes the security measures Quoli has in place today. We update it as we add controls, and we only list what is in place.
2. Where your data lives
- Quoli's application servers, database and cache run on Google Cloud in the United States.
- Review photos and videos are stored and delivered with Cloudflare.
- Review requests and other emails are sent through Amazon Web Services.
- Billing runs through Shopify, so Quoli never sees or stores card details.
3. Encryption
Traffic to Quoli, including connections to our database, is encrypted in transit with TLS. Data is stored with Google Cloud and Cloudflare, which encrypt it at rest.
4. Who can open your store's data
Merchants and their staff sign in to Quoli through Shopify, so Shopify's staff permissions control who can open the app. Quoli records which team member published, archived, featured or replied to each review.
5. AI providers
Quoli Intelligence sends review text, ratings and product details to our AI providers (OpenAI and Anthropic) only to produce the feature a merchant asked for, such as a reply draft or a summary. We do not use shopper data to train AI models. Drafts are never published until a merchant approves them.
6. Monitoring
Server logs are kept for a short period so our engineers can troubleshoot and fix errors.
7. Security testing
Quoli's platform has completed a vulnerability assessment and penetration test (VAPT). To ask about it as part of a security review, email support@quoli.io.
8. Incident response
If we become aware of a security incident that affects your data, we will notify affected merchants without undue delay and share what you need to meet your own notification duties.
9. Shopify customer data
Quoli reads customers' names, email addresses and phone numbers from Shopify orders to send review requests and to verify reviews against orders. We use this data only to provide the Service to the store it came from.
10. Report a vulnerability
If you believe you have found a security issue in Quoli, email support@quoli.io with the subject line "Security report" and the steps to reproduce it. Please do not access other merchants' data or disrupt the Service while testing. We look into every report.