Sécurité

QFacts is a web application that provides quality professionals with all the tools they need to manage the quality processes in their organizations. The application is built by QFacts BV (hereafter referred to as “QFacts”), a company located in Belgium, Decosterstraat 23, 3545 Halen with VAT number 1007.864.939.

In this security policy, we clarify how QFacts guarantees the quality and security, and prevents unauthorized usage of information. Below, we explain our technical and operational principles.

At the organizational level, there are 2 groups of users in QFacts. Organisation admins can invite new users to an organisation, add or alter roles, and edit organizational settings:

• Create a team
• Invite team members to the team

Users that are not registered as organizational admins do not have the aforementioned functionality. To perform actions in QFacts, a user has to be connected to at least one organization.

At the quality management level, there are different roles with their own responsibilities, access rights and authorisations:

QFacts is fully hosted by Google Cloud Platform, a recognized and publicly traded company with ISO27001:2013 certification. This certificate is the result of an extensive external audit in the field of security management and offers the most far-reaching guarantees regarding the security of the hosting environment.

Google Cloud Platform guarantees 99.9% uptime according to the Service Level Agreement (SLA).

QFacts works exclusively with Panenco BV (hereafter “Panenco”) for technical and development services. Panenco is a professional service provider with ISO27001:2013 certification, guaranteeing the highest standards in operational and technical security.

The technology behind QFacts consists of:

• PostgreSQL database
• React front-end application
• Node.js back-end application (REST API driven), with API endpoints secured via stateless authorization (JWT)

Assessment frameworks and procedures:

• Cypress.io for automated end-to-end testing
• Sentry.io for recording error messages
• The development team builds and tests new functions; the product manager and QFacts product team approve before deployment to production.

QFacts and Panenco have implemented physical security measures suitable for the level of risk resulting from the kind of information stored and activities performed at their offices.

Offices are located in buildings where access is restricted to authorized personnel. Visitors are accompanied in all non-public areas and are never left unsupervised. We never keep physical copies of personal data.

All employees of QFacts, and where applicable contractors, receive adequate education and training and frequent updates about the policy and procedures relevant for their function.