Safety
Is Quillen safe for my account?
No tool can guarantee that, and any tool that does is worth distrusting. What we can do is show you exactly what the code enforces before every single send, and name the things we deliberately do not claim.
Every number on this page was read out of the shipping code on 3 August 2026.
The controls, as numbers
These run in the posting path. They are not preferences you have to find and switch on.
| Control | What it is | Where it runs |
|---|---|---|
| Daily reply cap, Free | 10 replies a day | Checked before every send, not in a settings page |
| Daily reply cap, Starter | 20 replies a day | Checked before every send |
| Daily reply cap, Pro | 50 replies a day | Checked before every send |
| Daily reply cap, Team | 250 a day across the workspace, 50 per member | Both the workspace and the per-member cap are checked |
| Minimum gap between actions, X | 60 seconds, randomised up to 180 | Rate limiter, before the send |
| Minimum gap, LinkedIn via Unipile | 90 seconds, randomised up to 270 | Rate limiter, before the send |
| Minimum gap, LinkedIn official API | 300 seconds, randomised up to 900 | Rate limiter, before the send |
| Same post, replied to twice | Blocked for 30 days. Hard block | Deduplication, on the reply path |
| Same person, replied to repeatedly | Capped at 3 replies per rolling 14 days | Deduplication, on the reply path |
| Newly connected account | Cold replies blocked until 10 followers, 10 connections and 7 days | Warmup, the first gate in the posting path |
Will Quillen get my account banned?
No tool can promise that, and any tool that does is worth distrusting. What we can say is what the code enforces on every single send: a daily cap, a minimum gap between actions that is randomised rather than metronomic, deduplication so the same post and the same person are not hit repeatedly, and a warmup gate that blocks a brand new account from cold replying at all. Those run in the posting path, not in a settings page you have to remember to configure.
Does anything post without me approving it?
On X, no. It is structurally impossible: the autopilot flag is deleted for any campaign that includes X, so it cannot be stored, let alone acted on. On LinkedIn, yes, if you deliberately turn autopilot on. It is Team plan only, off by default, switched on per campaign by you, and re-checked at the moment of posting so that a lapsed subscription stops it mid-flight. A draft that fails the voice lint never auto-posts; it falls back to your review queue.
Does Quillen use my login cookies or a browser extension?
No. There is no cookie handling anywhere in the codebase, no session token storage, and no browser extension. Quillen runs server side. That distinction is the whole design: an extension acts inside your own logged-in browser session, which makes the activity indistinguishable from you clicking, and puts the risk on your account.
Does Quillen use official platform APIs?
Partly, and the honest answer is more useful than the marketing one. Posting to X uses the official X API. Posting and replying on LinkedIn goes through Unipile, a sanctioned provider running a session API, which is not the same thing as an official LinkedIn API. Discovery reads on X go through twitterapi.io, a third-party aggregator. We would rather name that distinction than blur it.
How does the randomised timing actually work?
Each gap is drawn from a window between the platform minimum and three times that minimum, so intervals are irregular rather than perfectly regular. Two properties matter. The draw can only ever delay a send, never release one early, because the window starts at the minimum. And it is seeded rather than random, so a retried job computes the identical gap: a draft cannot be let out early just by being reattempted.
What does the warmup gate actually do?
It blocks cold replies from a newly connected account until that account has 10 followers, 10 connections and 7 days of history. It is the first gate in the posting path, ahead of deduplication and rate limits, and the database default is blocking rather than open. It is a gate, not a ramp: read the limits section below for what it does not do.
What we do not claim
We have shipped copy describing guardrails we had not actually built. Rather than quietly correct it, here is the list, so you can hold the rest of this page to the same standard.
- Warmup eases an account in gradually
- It does not. Warmup is a binary gate, not a volume ramp. Nothing in the codebase scales any cap by account age. When an account clears the threshold it goes from blocked to the full plan cap in one step. We used to describe this as easing an account in; that was wrong and we removed it.
- Warmup always ends automatically
- Only on LinkedIn. Automatic promotion out of warmup is LinkedIn only, so on X the one way out is an operator bypass in the dashboard. That bypass performs no plan check and no account-age check.
- Everything runs on official platform APIs
- It does not, and we no longer say it does. LinkedIn writes run through a sanctioned provider on a session API, and X discovery reads run through a third-party aggregator. Only X posting is an official platform API.
- Nothing ever posts without a human
- True on X, and true everywhere by default. Not true if you are on Team and switch autopilot on for a LinkedIn campaign yourself. We used to state the promise without the exception, including in our Terms; that was false for exactly the customers paying us most, and we corrected it.
- These controls guarantee your account is safe
- They do not. Platforms enforce against patterns, and no vendor controls their enforcement. These controls are what we can prove we do. They are not a warranty, and you should not treat any competitor claim of one as credible either.
More on how platforms actually detect automation in does comment automation get accounts banned. If something here does not match what you see in the product, tell us at [email protected] and we will fix the page or the code.