Qoria Trust Centre

Security operations center (SOC & SIEM): Our SOC continuously monitors our cloud environment for threats. 

Incident management: Our Incident Response plan governs how we identify, contain and recover from incidents. 

Incident simulation testing: The response capability of our organization, executives & engineers are tested in annually simulated cyber attacks / tabletop exercises.

Data encryption (transit and rest): Our products are hosted in the world’s top cloud providers, giving us industry-leading, out of the box capabilities for encryption during transport and at rest.

Endpoint detection and response (EDR): We use industry leading endpoint detection and response across our enterprise and infrastructure assets.

Disaster Recovery: Critical data is backed up with top tier regional redundancy in place and infrastructure as code, and designed to be restored quickly if needed.

Identity and access management: User and admin account hygiene is monitored carefully. MFA is enforced on key systems with hardware token based MFA required for highly privileged access.

Vulnerability identification: We use multiple mechanisms to continuously discover vulnerabilities across our global infrastructure (including both internal and external assets) and code base. 

Attack surface management: We continuously monitor our external attack surface and products for misconfigurations and vulnerabilities at least daily. 

Dedicated in-house security & data privacy capability: We have dedicated expertise in product and application security, cloud security, data privacy, enterprise security and more. These teams and our overarching security and privacy strategy are managed by our Chief Information Security Officer.

NIST framework: Our security investments are guided by industry standard and risk based frameworks, such as NIST.

Employee background checks: Our employees are all background checked. 

Data breach notification: We provide notification to customers of data breaches inline with all relevant regulatory requirements.

Vulnerability management: Our internal vulnerability management policy governs how we identify and respond to vulnerabilities. 

Employee privacy and security awareness training: All staff are required to undergo LMS based training in cyber security along with security briefings to connect with the security team. 

Vendor / third party risk management: Vendors and third party products are risk assessed via our third party risk management process. 

IT security & privacy policies: We have a number of security policies which govern data privacy, incident response, identity and access, asset security, acceptable use, vulnerability management and more.

Asset management: We have in place comprehensive internal and external asset management to ensure that we maintain a reliable view of our security posture. 

Data security posture management: We take proactive steps to minimize data storage and processing in our environment and ensure that risks to data are actively minimized.

Data center security: We use industry leading data centers which are compliant with SOC 2, HIPPA, PCI DSS and ISO 27001.

Code vulnerability scanning & management: We scan our code for dependency vulnerabilities and our policy governs how and when teams are expected to fix these. 

Penetration testing: We perform penetration testing at least annually (sometimes more regularly) on our products.

Responsible disclosure reporting: We encourage external researchers to report any vulnerabilities they find in our products so that we can address them quickly.

Secure-by-design software development: Security is a key consideration in software and feature development from the outset - our security team is involved in the review of each new initiative & build design. 

Privacy-by-design software development: Privacy is a key consideration in software and feature development from the outset - our privacy team is involved in the review of each new initiative.