Security at InventoryQuick
Who handles sign-in, payments, hosting and AI processing, what each one publishes about its own security, and how you can export or delete your data.
Last reviewed: October 17, 2026
Sign-in
Auth0 handles sign-in.
If you sign in with a password, you enter it on Auth0's login page. InventoryQuick does not receive or store it.
Auth0 states that it undergoes SOC 2 Type 2 and ISO 27001/27017/27018 audits by an independent auditor every year, and that it is CSA STAR certified.
Payments
Stripe handles card payments.
On our website you enter card details on Stripe's checkout page, so InventoryQuick does not receive or store card numbers.
Stripe states that it is certified to PCI Service Provider Level 1, the most stringent level of certification available in the payments industry, and that it produces SOC 1 and SOC 2 Type II reports every year.
Source: Stripe: security
In transit
Traffic is encrypted with TLS.
Traffic between your browser or phone and InventoryQuick is encrypted with TLS (HTTPS). Plain HTTP requests to our website, web app and API are redirected to HTTPS, and the website and web app send an HSTS header.
Hosting
Railway and Vercel host InventoryQuick.
The API and database run on Railway. The website and web app are served by Vercel.
Railway states that it is SOC 2 Type II and SOC 3 certified. Vercel states that it holds a SOC 2 Type 2 attestation for Security, Confidentiality and Availability, and that it is ISO 27001:2022 certified.
Source: Railway: compliance · Vercel: security and compliance
AI features
Anthropic processes AI requests.
The IQ Assistant and our AI features are powered by Claude, from Anthropic. Your inventory data may be sent to generate responses, and any photo, receipt or PDF you upload for AI recognition or document import is sent to Anthropic to be read. No other AI provider receives your data.
Anthropic's Commercial Terms state that it may not train models on Customer Content from its services. Its privacy center states that for API users it automatically deletes inputs and outputs on its backend within 30 days of receipt or generation, unless it must keep them longer, for example to enforce its Usage Policy or to comply with the law.
Source: Anthropic: Commercial Terms of Service · Anthropic: how long data is stored
Your data
Export it or delete it yourself.
Export your items as a CSV file from the Items page at any time. You can delete your account yourself in Settings. Under our Privacy Policy, we then delete your data within 30 days, except where we are required to keep it for legal or compliance reasons.
We do not sell your data.
Report a security problem
Email support@inventoryquick.com with Security in the subject line and the details of what you found.
What this page does not claim
The certifications named above are held by the providers named beside them. InventoryQuick does not currently hold a SOC 2 or ISO 27001 certification of its own. What each provider states is shown as it appeared on the linked page on October 17, 2026; follow the link for its current text.