Squarespell Quiz security: Your account and your leads, protected.
How Squarespell Quiz keeps your account, your quizzes and the people who answer them safe.
How we protect your account.
Sign-in
Passwords are never stored. We keep only a scrypt hash of each password. You can also sign in with Google.
Sessions
Your session lives in a secure, HttpOnly cookie that scripts on the page cannot read, and app requests use short-lived tokens.
Hosting
The app and its database run on our own server at Hostinger, with daily backups kept for 14 days.
Payments
Payments are processed by Stripe. Card numbers go straight to Stripe and never reach our servers.
Connected tools
Keys and credentials for Mailchimp, Klaviyo, Kit, Google Sheets and other connections are encrypted with AES-256-GCM before they are stored.
Emails are sent from our own mailbox. Every marketing email has a signed unsubscribe link and an unsubscribe header.
Rate limits
Sign-in, lead capture and data requests are rate limited to slow down abuse and automated attacks.
AI
Quiz drafts and AI email suggestions are written with Anthropic's Claude models. Nothing the AI writes is published until you click Publish.
Team access
On Business, team members get a role (owner, admin, editor or viewer) so each person sees only what they need.
Tools for data requests.
Quizzes can record consent, and every lead's data can be exported or deleted from your dashboard.
- Consent records for each lead
- Export a person's data on request
- Delete a person's data on request
- People who took a quiz can request deletion themselves, confirmed by email
Found a security issue?
Please email info@squarespell.com with the details and how to reproduce it. Please do not access other people's data or disrupt the service while testing. We will reply and keep you updated while we fix it.
Your next lead is one quiz away.
Paste your website. Get a branded quiz draft in about a minute, then edit everything before it goes live.