Security Policy

Qualzy takes data security very seriously. We make every effort to ensure that your data is kept secure and that we collect and store only the personal information required to administer your account and make your use of the software as efficient as possible. We have detailed below all steps taken by us to ensure the security of your data.

Compliance and regulatory standards

Qualzy ensures compliance with international data protection and security regulations, including:

• The General Data Protection Regulation (GDPR)
• The California Consumer Privacy Act (CCPA)
• The Australian Privacy Act
• The Health Insurance Portability and Accountability Act (HIPAA)
• The Children's Online Privacy Protection Act (COPPA)

Our practices align with these frameworks to protect data integrity, confidentiality, and availability. Qualzy maintains administrative, physical, and technical safeguards consistent with these standards and performs periodic reviews of its information security controls.

Storage and security of personal information

At any time that Qualzy has possession or control of a record that contains personal information, we ensure:

1. that the record is protected by such security safeguards as it is reasonable in the circumstances to take, against loss, against unauthorized access, use, modification or disclosure, and against other misuse; and
2. that if it is necessary for the record to be given to a person in connection with the provision of a service to Qualzy, everything reasonably within the power of the Qualzy is done to prevent unauthorized use or disclosure of information contained in the record.

We have in place appropriate disposal arrangements for records containing personal information. Destruction of records is secure.

Application and user security

Qualzy uses advanced commercially available technology to secure each user's internet session.

When a user registers with Qualzy, they must create a unique username and password that must be entered each time they log on. User data in the database is segregated logically by user account-based rules.

User passwords have requirements for complexity and length and are individually salted and hashed.

All areas of the site use Transport Layer Security (TLS) to protect user data during transmission. This includes all sensitive data such passwords and all responses submitted by research participants.

All credit card payments are processed by our payment gateway provider, Stripe. Stripe holds the highest level of PCI DSS accreditation - strict global security standards to ensure this information is properly protected.

All applications undergo independent penetration testing to OWASP10 guidelines annually and at each major release, whichever is first.

Data centre physical security

Physical access is controlled at building ingress points by professional security staff utilizing surveillance, detection systems, and other electronic means.

Physical access points to server rooms are recorded by CCTV.

Electronic intrusion detection systems are installed within the data layer to monitor, detect, and automatically alert appropriate personnel of security incidents. Alarms are immediately dispatched to 24/7 Security Operation Centers for immediate response.

Infrastructure and network security

Qualzy uses Amazon Web Services for the hosting of all servers and data stores. We operate in three major regions allowing you to have control over the residency of your data. Each region operates in isolation with no data transmitted between the different regions.

Qualzy.com.au is hosted in Australia.

Qualzy.com is hosted in the United States of America.

Qualzy.co.uk is hosted in the United Kingdom.

The Hosting Infrastructure and Network Security Features include:

• 24x7 Monitoring of Network Traffic
• Redundant power supplies and environmental controls
• Low latency and highly available
• ISO 27001:2013, ISO 27017:2015, ISO 27018:2019 compliant
• Regular security and application patching and auditing ensure minimum vulnerability footprint on OS layer.
• Vulnerability scans and reviews are performed at least annually

Digital data storage security

Data is stored on encrypted disk subsystems using AES-256 encryption, with continuous backup retention for 90 days.

Retention periods align with regulatory requirements, and data is securely disposed of when no longer needed, in accordance with NIST 800-88 standards.

Software development practices

We code in Microsoft technologies, including C#.

Our engineers use best practices and industry-standard guidelines for software development and the security of code.

All applications undergo independent penetration testing to OWASP10 guidelines bi-annually and at each major release, whichever is first.

Disaster recovery

Qualzy makes every effort to ensure that no data is lost. In the event of such an incident, the company will follow a documented Disaster Recovery and Business Continuity Plan (DRP). The DRP is tested quarterly to validate its effectiveness, identify potential gaps, and validate that critical systems can be restored securely and efficiently.

Handling of security and data breaches

No method of communication or transmission over the Internet is perfectly secure despite everyone's best efforts. Whilst we cannot guarantee absolute security, if Qualzy learns of or is advised of a potential security or data breach, we will follow our Incident Response Plan which includes, but not limited to the following:

• Form a team consisting of senior personnel and IT personnel.
• Investigate the incident.
• Investigate what information has been compromised (e.g. usernames, passwords, survey response data).
• Immediately take action to determine the nature and scope of the breach and take action to prevent further data loss.
• Notify and report the data breach to affected users and local governing bodies, if appropriate.
• Take action to remediate the breached data.
• Take action to prevent future breaches.

In the event of a confirmed data breach, Qualzy will notify the relevant Client without undue delay. The Client is responsible for notifying affected individuals and regulators, except where we are legally required to do so directly.

Employee and contractor security training

All employees and contractors receive annual security training, including training on handling sensitive data under GDPR, HIPAA, COPPA, and CCPA. Ad-hoc training sessions are conducted following any changes in policies or regulations.

Qualzy sub-processors

Qualzy uses sub-processors with the provision of our services to our customers. These sub-processors may process customer data. The identity, processing activity, and processing location of each sub-processor is listed in the table below.

Further security information

If you have any concerns or questions, please contact us at privacy@qualzy.com.