Security and trust
The security posture matches the sensitivity of what you are storing.
Compliance records name staff. Complaints records name complainants and describe what happened to them. That is not ordinary business data, and the platform is built accordingly.
Encryption
Encrypted at the field, not just at the disk.
Sensitive values are encrypted individually with AES-256-GCM under an envelope scheme, so a value is protected as a value rather than only as part of a disk image. Where a field has to remain searchable, a separate hash makes lookup possible without decrypting the record.
Encryption at the field level is more work to build and considerably more work to maintain than encrypting the volume and calling it done. It is the difference between data that is protected while it is being used and data that is only protected while the machine is switched off.
- AES-256-GCM envelope encryption on sensitive fields
- Searchable hashes, so lookup never requires decryption
- Encrypted in transit and at rest
The rest of the posture
What is actually in place.
Australian data residency
Your data is hosted in Australia. For an RTO answering to an Australian regulator about Australian students, that is not a preference — it is the answer to a question you will be asked.
Row-level security
Permissions are enforced on every table in the database rather than in the interface, so what a person can see is decided where the data lives. A missing check in a screen cannot leak a record.
Multi-factor authentication
Available on every account, with authenticator codes and backup codes. Administrators can see which accounts have not enabled it yet.
A complete audit trail
Every change records who made it, when, and what the value was before. Closure accounts are append-only. Nobody, including an administrator, can edit the log.
Impersonation, recorded both ways
When an administrator acts as another user, it is recorded on their account and on the account they acted as. Support access is never invisible to the person it affects.
Privacy by design
Complaints and appeals carry personal information about people who are already in a difficult situation. Access to those records is scoped tightly and the access itself is logged.
Questions we get asked in procurement
Where is our data stored?
In Australia. If your procurement process needs the specific region and provider in writing, ask us and we will put it in writing.
Who at Qualticks can see our records?
Support access is scoped and logged. When a member of our team acts as one of your users, it is recorded on both accounts and is visible to you, not just to us.
Can we get our data out?
Yes. Exports are part of the product rather than an offboarding favour, and they produce documents from the same records the work is done in.
Do you hold SOC 2 or ISO 27001?
No. Neither is held today. We will say so here when that changes, with the date and the scope of the certificate.
Is multi-factor authentication required?
It is available on every account and administrators can see who has not enabled it. Whether it is mandatory is your policy decision, not ours.
Bring us your security questionnaire.
We would rather answer it properly than have you guess from a page. Book a demo and we will go through it with you.