Trust & Security

HqO's solution is compliant with various data protection laws and regulations where our customers are residing, such as GDPR, CCPA, and PIPEDA. View our Privacy Policy for more details.

HqO also leverages a number of third-party applications and services in support of the delivery of our solution to customers. We recognize that the company's information assets and vendor dependencies are critical to our continuing operations and delivery of services. As such, we have established a vendor management program that sets forth the requirements to be established and agreed upon when HqO engages with third parties or external vendors. For a complete list of HqO's sub-processors, please refer to our Data Processing Addendum document on our Legal Hub.

HqO is committed to safeguarding the privacy and data protection of our global customer base. Our dedication to these principles is evident in our adherence to the Data Privacy Framework (DPF), which encompasses the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. DPF serve as pillars ensuring that HqO adheres rigorously to data protection regulations, facilitating the seamless transfer of personal data from the European Union, the United Kingdom, and Switzerland to the United States, fully aligning with EU, UK, and Swiss laws, respectively. For a detailed overview of our data protection practices, please consult our Privacy Policy. At HqO, we prioritize the protection of your data above all else. Our commitment to continuous enhancement drives us to consistently improve our data protection measures, guaranteeing that our services not only meet but exceed the ever-evolving data privacy standards across all jurisdictions in which we operate.

HqO maintains a comprehensive set of security policies and procedures which are communicated and accessible to all employees. We ask our employees during their onboarding and annually thereafter to read and understand these policies and procedures. We also plan, run, and continuously improve security awareness campaigns across the company to ensure all employees are aware of security best practices and how to best protect customers and other business information. 

All policies and procedures that we have internally are bound to regular review at least annually. We also perform tests and compliance controls on all these areas to ensure that the measures are running effectively.

We host customer data on Amazon Web Services (AWS) infrastructure in the US East region data center located in Northern Virginia and the EU Central region data center located in Frankfurt, Germany. All primary instances of our infrastructure are replicated in real-time to secondary instances across multiple availability zones to ensure high availability service.

All data is encrypted during transmission and at rest. Backup snapshots of the database are captured at 5-minute intervals and retained for 30 days. 

For ensuring the continuous security of our production environment, security vulnerability scanning is performed every 2 weeks using a third-party solution. Every year an external party performs a penetration test on our applications (web and mobile) and infrastructure. All identified observations are tracked and resolved according to the policy and procedure previously defined.