Trust Centre

Security and Compliance

Q:chi's software as a service is built for organisations where data protection, financial governance, and regulatory compliance are not optional. Here is how we protect your data and earn your trust.

How We Protect Your Data

Encryption at Every Layer

Your data is protected both in transit and at rest using industry-standard encryption protocols.

TLS 1.2+ for all data in transit
AES-256 encryption for data at rest
Encrypted database backups stored in geographically separated locations
Secure key management with regular rotation

Role-Based Access Control

Every user sees only what they need to see. Access is governed by configurable roles that align with your organisational structure.

Granular permission sets by role, region, and business unit
Single Sign-On (SSO) via SAML 2.0 and OAuth
Multi-factor authentication (MFA) support
Automatic session timeout and IP restriction options

Complete Audit Trail

Every action in Q:chi ) Harmoni and Q:chi ) Affiniti is logged with a full audit trail, giving you complete visibility into who did what and when.

Immutable logs for all budget changes, approvals, and data modifications
Timestamped records with user identification
Exportable audit reports for internal and external review
Designed to meet financial governance and regulatory requirements

Infrastructure and Hosting

Q:chi's software as a service is hosted on enterprise-grade cloud infrastructure with redundancy, monitoring, and disaster recovery built in.

Hosted in ISO 27001 certified and SOC 1 & SOC 2 Type II audited data centres
Multi level backup architecture
99.9% uptime SLA for enterprise customers
24/365 infrastructure monitoring and incident response

Application Security

Security is embedded in our software development lifecycle, from design through testing to production deployment.

Regular penetration testing by independent third parties
Automated vulnerability scanning
OWASP Top 10 mitigation as standard practice
Responsible disclosure policy for security researchers

Data Residency and Sovereignty

For organisations with specific data residency requirements, Q:chi's software as a service supports configurable hosting locations to meet regional regulatory obligations.

Multi region data centre options available
Data processing agreements tailored to your jurisdiction
Support for cross-border data transfer frameworks
Configurable data retention and deletion policies

Compliance Frameworks

Q:chi's software as a service is designed to help your organisation meet its regulatory and governance obligations across multiple frameworks.

ISO 27001

Independently certified information security management system covering all Q:chi's operations, products and services.

GDPR

Full compliance with the General Data Protection Regulation, including data subject rights, lawful processing, and breach notification procedures.

Financial Governance

Built-in controls for budget approval, spend authorisation, and audit trail requirements that align with SOX and similar financial compliance frameworks.

Data Processing

Standard Data Processing Agreements available for all customers, with provisions for sub-processor management and data transfer mechanisms.

Security Questions

Common questions from enterprise security and procurement teams.

Where is my data hosted?

Q:chi's software as a service is hosted in ISO 27001 certified and SOC 1 & SOC 2 Type 2 data centres. For enterprise customers, we can offer multi region hosting location options including the UK and EU to meet data residency requirements. All hosting environments are managed with the same security controls and monitoring standards regardless of location.

Do you support Single Sign-On?

Yes. Q:chi's software as a service supports SSO via SAML 2.0 and OAuth, allowing your users to authenticate through your existing identity provider (such as Azure AD or similar). This means your team can access Q:chi's software as a service using their corporate credentials with the same authentication policies your IT department already enforces.

How do you handle data backups?

Automated encrypted backups are performed regularly and stored in geographically separated locations from the primary hosting environment. Backup integrity is tested on a scheduled basis, and our disaster recovery procedures are documented and rehearsed as part of our ISO 27001 management system.

Can you provide a penetration test report?

Yes. Q:chi's software as a service undergoes regular penetration testing by independent, accredited third-party firms. Summary reports are available to enterprise customers and prospective clients under NDA as part of the security review process.

What happens when a security incident occurs?

Q:chi maintains a documented incident response plan as part of our ISO 27001 management system. In the event of a security incident, affected customers are notified within the timeframes required by applicable regulations. Our 24/365 support team monitors for threats continuously and escalates incidents through a structured response process.

How do you manage sub-processors?

If sub-processors are involved in the delivery of Q:chi services they have to be thoroughly assessed against our security standards and bound by data processing agreements. Customers are notified of any changes to sub-processor arrangements in accordance with our Data Processing Agreement terms.

What data retention policies do you offer?

Data retention periods and export provisions are detailed in your individual contract. Upon contract termination, Q:chi will work with you to ensure your data is made available to you, with the scope and format of any data extraction agreed as part of the offboarding process. Data is securely deleted from our systems within the timeframe specified in our Data Processing Agreement.

Do you complete security questionnaires?

Yes. Our team regularly completes customer security questionnaires and supports standard assessment frameworks including Cloud Security Alliance CAIQ (Consensus Assessments Initiative Questionnaire). We can provide a security information pack to help accelerate procurement and vendor assessment processes.