Qualzy is ISO 27001:2022 certified, and security, privacy and compliance run through every part of it, from the way participants take part to the way you analyse what they say.
Visit the Qualzy Trust Centre (opens in a new tab)Qualzy is ISO 27001 certified, independently audited and continuously monitored. ISO 27001 can't be self-certified: keeping it means passing an external audit and annual surveillance audits.
"We invested in the process globally and ultimately crossed the line following months of rigorous review led by our CIO."
The certification covers our entire information security management system: how data is handled, stored, accessed, and protected across the platform.
All data stored in Qualzy is encrypted using AES-256, so participant data is encrypted wherever it's stored.
All data moving between participants, researchers, and Qualzy servers is encrypted via TLS 1.2 or higher. Every connection (from participant upload to researcher analysis) is secured in transit.
Always-on monitoring, firewalls, anti-malware and regular penetration testing, so threats are picked up and dealt with early.
Qualzy operates across the UK, US and Australia, and our compliance programme covers the data protection rules in each of those markets, so you know where you stand wherever your clients are.
Full compliance with UK and European data protection regulations. You remain the data controller and we act as processor, with data processing agreements available on request. Participant consent is managed within the platform, with a full audit trail.
California Consumer Privacy Act compliant. US-based participant data is handled in accordance with CCPA requirements, including the right to know, delete, and opt out.
Compliant with the Privacy Act 1988. Projects created in our Australian region are hosted in Australia, which matters for many government and enterprise engagements.
Children's Online Privacy Protection Act compliant. Research with children under 13 runs only with the right safeguards in place, protecting both researchers and participants.
Health Insurance Portability and Accountability Act compliant. Qualzy supports healthcare and pharma research teams with appropriate safeguards for handling protected health information.
We don't sell participant data, we don't train AI on your research, and we don't share anything without your instruction. Here's how that works in practice.
You decide what's collected and why. We act as your processor, and data processing agreements are available on request.
Responses, transcripts and participant data are never used to train Maizy or any other AI model. Run through Amazon Bedrock, the AI stays in your project's home region.
We don't share participant data with third parties without your explicit instruction. There's no advertising targeting and no selling of data.
Participants can ask to see, correct or delete their personal data, as our Privacy Policy sets out. You can remove participants from a project, or make them anonymous.
Each region runs separately on AWS, and a project is hosted in the region it's created in. That lets you meet each client's requirements, whether their research belongs in the UK, the US or Australia. Researching in mainland China? A dedicated China proxy keeps access stable for participants and researchers there. More on research in China.
Research projects involve clients, stakeholders and moderator teams who each need to see different things. Qualzy's access model is built around that.
Required for all admin and researcher accounts. It adds a second check at sign-in, so a stolen password isn't enough on its own to get into an account.
Moderator, observer, recruiter, and admin roles, each with distinct permission levels. Assign the right access to the right person without sharing more than is needed.
Client stakeholders can be given read-only observer access to live fieldwork, seeing exactly what they need without any moderator permissions. A simple way to keep end clients involved while fieldwork runs.
Fine-grained permissions at project and participant level. Control who can see which participants, activities and data.
Each policy applies globally and covers the requirements of the UK and EU (GDPR), Australia (Privacy Act 1988) and the United States (CCPA).
Questions about any of these documents? Contact us directly. You'll hear back from a real person, not a ticket system.
Qualzy's Trust Centre at trust.qualzy.com is a dedicated hub for ongoing compliance documentation, security policies, audit certificates, and real-time security monitoring. Available to clients and prospects on request. You can read our Security Policy, along with all our other policies, in our policies above.
Book a 15-minute call and we'll take you through how Qualzy handles security, privacy and compliance, and the documents your client will ask for.
