Quarterly board reviews provide formal oversight of organizational, internal control, and information security risk management strategies. Executive visibility at this level helps keep security aligned with business priorities.

Board membership includes individuals who operate independently from management, strengthening objective oversight and governance. Independent review helps reinforce accountability and balanced decision-making.

Leadership engages a third-party advisor to support oversight of risk management and data security initiatives. Independent expertise adds additional scrutiny to key security decisions.

Oversight responsibilities are defined, documented, and acknowledged by the board each year. Clear governance expectations help sustain consistency and accountability over time.

Responsibility for overseeing information security and risk management is formally assigned. Defined ownership supports timely decisions and clear accountability for protecting customer data.

A documented organizational structure defines reporting lines, authorities, roles, and segregation of duties. Clear separation of responsibilities helps reduce the risk of error, misuse, and unauthorized activity.

Job descriptions are maintained and communicated to identify the skills and requirements for each role. Clear expectations support appropriate staffing and role-based accountability.

Hiring follows a formal screening process designed to align candidates with company standards and job requirements. Structured hiring helps reduce personnel risk before access is granted.

Background checks are completed before employees are onboarded. This adds an additional safeguard when evaluating personnel who may handle sensitive systems or data.

Employees receive information security training at hire and annually thereafter. Regular education helps reinforce secure behavior and support compliance obligations.

Employees are required to acknowledge the information security policy, including acceptable use requirements, upon hire. Ongoing access to these policies helps reinforce day-to-day compliance.

Security policies are reviewed and approved by management each year. Regular review helps keep requirements current as risks and business operations evolve.

Data classification and handling practices are formally defined within security and data protection policy documentation. Clear standards support consistent protection of sensitive information.

Employees acknowledge an employee handbook that includes the code of conduct and sanctions for policy violations. Documented consequences help reinforce responsible behavior and accountability.

Documented procedures govern how data is retained and disposed of. Defined lifecycle practices help reduce unnecessary data exposure and support compliance requirements.

A formal program is in place to manage, monitor, and mitigate information security, confidentiality, and availability risks. Structured risk governance helps prioritize security efforts based on business impact.

Risk assessments are performed at least annually to identify information security risks, including fraud risk. Regular assessment helps the organization respond to changing threats and business conditions.

Identified risks are logged in a risk register, with mitigation actions assigned and tracked through completion. This creates accountability for timely follow-up and risk reduction.

Internal control responsibilities are assigned to designated control owners within a governance, risk, and compliance process. Clear ownership supports consistent execution and monitoring of key controls.

Inbound customer communications are tracked and prioritized through a ticketing process until resolution. This supports responsive service and better follow-through on customer concerns.

Users are provided with contact information in the public privacy policy to report security concerns. A visible reporting channel helps surface issues quickly and improves trust.

Terms of service define the responsibilities of both Qount and its customers for data protection and platform availability. Clear allocation of responsibilities helps reduce ambiguity in shared operations.

A public status page is maintained to communicate uptime issues and security incidents. Transparent service communications help customers assess operational impact in real time.

Access to production systems, including administrative access, is limited to authorized personnel based on job need. Restricting privileges helps reduce the impact of misuse or compromise.

Additional authentication is required for user login to production systems. This reduces the risk of account takeover from stolen or reused credentials.

Production access is protected by enforced password length and complexity requirements. Stronger credential standards help defend against common password-based attacks.

Production access follows a formal provisioning process that requires approval from system owners. Approval-based onboarding helps ensure access is granted intentionally and appropriately.

User access to production systems is independently reviewed at least annually against job duties, and removals are documented. Periodic review helps prevent unnecessary or outdated access from persisting.

System access is removed within two business days of termination through a formal offboarding process. Prompt deprovisioning helps reduce exposure from inactive or former-user accounts.

Terminated employee devices are locked and or wiped as part of offboarding. This helps protect company information that may remain on managed devices.

Users must authenticate to a VPN before accessing the production environment. Requiring a controlled access path adds another layer of protection around sensitive systems.

Activity for the highest-privilege cloud account is logged for awareness and accountability. Enhanced visibility over privileged actions supports investigation and deterrence.

The highest-privilege cloud account is protected with multi-factor authentication. Stronger safeguards on critical accounts help reduce the risk of catastrophic unauthorized access.

Company workstations are protected with antivirus, and definition updates are pushed automatically. Centralized malware protection helps keep endpoints current without relying on user action.

A device management program enforces security policies on company workstations, including encryption, operating system updates, lockout settings, password parameters, and multi-factor authentication. Centralized enforcement improves consistency across the fleet.

Windows-based virtual machines are protected with antivirus to help defend against malicious software. Applying workload protection beyond user devices helps reduce operational risk in hosted environments.

Object storage buckets that house customer data are configured to disallow public access. This reduces the risk of accidental exposure through open storage settings.

Sensitive customer data stored in databases and object storage is encrypted at rest, including backups. Encryption helps protect information if underlying storage is accessed without authorization.

Database encryption keys are stored separately and access is limited to authorized users. Tight control over key access strengthens the protection provided by encryption.

Connections from web browsers to the application are encrypted to protect data sent over public networks. This helps preserve confidentiality and integrity during normal platform use.

Connections between the document management service and customer storage drives or workstations are encrypted. Securing these transfer paths helps protect sensitive documents in transit.

Non-internet-facing resources are deployed in private network segments rather than being exposed directly to the public internet. This reduces the attack surface around internal systems.

Private resources use a controlled gateway for network egress. Constraining how internal systems reach external services supports stronger network boundary management.

A web application firewall is used to help prevent unauthorized access threats from outside the production environment. This adds a defensive layer for internet-facing application traffic.

Network security rules are configured to allow only authorized traffic to production resources. Restricting communications helps limit unnecessary exposure and lateral movement.

A centralized monitoring capability aggregates production event logs and alerts the security team. Consolidated visibility improves detection and response across the environment.

Access requests to storage buckets containing customer data are logged. Detailed access records support investigations and help demonstrate accountability for data access.

Network traffic to and from the production environment is logged to help identify unusual or anomalous activity. Traffic visibility strengthens monitoring for unauthorized behavior.

Account activity throughout the production environment is logged, with log storage encrypted and access restricted to authorized personnel. Protecting logs helps preserve their integrity and investigative value.

Infrastructure monitoring and threat detection tools are used to watch for potentially malicious activity and feed alerts into centralized analysis. Integrated monitoring improves the chance of early detection.

Independent penetration tests are performed every year. External testing provides objective validation of the security posture and helps identify weaknesses before attackers do.

High-risk issues identified during penetration testing are reviewed and tracked through remediation. Formal follow-up helps ensure testing leads to measurable risk reduction.

Container images are scanned for vulnerabilities each time a new image is sent to the registry. Continuous scanning helps catch issues earlier in the release process.

Critical and high-risk vulnerabilities found in container images are logged and tracked to completion. Structured remediation helps focus effort on the issues with the greatest potential impact.

Code changes are required to undergo vulnerability scanning, dependency scanning, and static application security testing before release to production. Multiple review layers help reduce the chance of introducing exploitable flaws.

Development and production environments are maintained separately. Environment separation helps prevent non-production activity from affecting live customer systems.

Code changes, including emergency changes, require peer review and approval by authorized reviewers before merging. Independent review helps reduce defects and unauthorized changes.

New features are tested for functionality before deployment to production. Pre-release validation helps protect service quality and reduce change-related incidents.

Application and infrastructure changes to production can be deployed only by authorized employees. Limiting deployment authority reduces the risk of unapproved or accidental changes.

Production data is not used outside the production environment. Keeping live data out of non-production contexts helps reduce unnecessary exposure of customer information.

Software development lifecycle procedures are documented and include segregation of duties and secure coding practices. Formalized development controls support repeatable and defensible engineering processes.

Employees have a formal process for reporting identified or suspected security incidents, including fraud or data breaches. Clear reporting paths help the organization react faster when issues arise.

Incident response policies and procedures include an escalation plan based on incident nature and severity. Defined response steps support coordinated action under pressure.

Security-related incidents are reviewed to determine root cause and capture lessons learned. Post-incident analysis helps strengthen controls and reduce repeat events.

Incidents are documented in a ticketing system, resolved in a timely manner, and communicated to appropriate internal and external parties. Structured case management supports accountability and transparency.

The incident response plan is tested and documented at least annually. Regular exercises help confirm readiness before a real event occurs.

Object storage containing customer data is versioned to preserve prior states. Versioning helps recover from accidental deletion or unwanted changes.

Production databases are backed up automatically each day, with retention based on business need. Routine backups support operational recovery and continuity.

Backup restoration is tested annually for databases, object storage, and configuration files. Recovery testing helps verify that backups are usable when needed.

Critical production resources are replicated across availability zones to support failover. Redundancy helps reduce the impact of localized infrastructure disruption.

Failover testing is performed each year to validate preparedness for disruption scenarios. Exercising recovery paths increases confidence in resilience planning.

A formal disaster recovery and business continuity plan is maintained. Documented planning helps coordinate recovery of systems and business operations during major events.

The disaster recovery and business continuity plan is tested annually, including information system recovery and continuity scenarios. Regular exercises help validate operational readiness.

A cybersecurity insurance policy is maintained to help mitigate the business impact of cyber-related disruption. Financial preparedness can support response and recovery activities during significant incidents.

Autoscaling is configured for critical production resources to support service resilience during changing demand. Elastic capacity helps maintain performance under load.

System capacity and performance are monitored, with alerts for high-risk events and tracked remediation when action is required. Active monitoring helps prevent avoidable service degradation.

Web application performance and availability are continuously monitored, with uptime alerts sent for review and remediation. Timely awareness supports faster response to service interruptions.

A formal program is used to define and assess vendor risk, implement mitigating controls, and manage vendor relationships. Structured oversight helps reduce dependency-related security gaps.

Due diligence is performed for high-risk vendors before contract execution and annually thereafter. Ongoing review helps confirm that critical third parties continue to meet expectations.

Vendor due diligence includes documented review of independent attestation reports. External assurance evidence helps support more informed vendor risk decisions.

High-risk vendors and contractors are bound by agreements that define information security terms, conditions, and responsibilities. Contractual safeguards help set enforceable expectations for third parties.