Security at Qiq

Last updated: 30 Oct 2026

Who We Are

Qiq LLC (“Qiq”, “we”, “us”, “our”) provides scheduling and business management software-as-a-service to solo professionals and small teams. Because our customers trust us with sensitive business information, we treat security as a first-class product feature, not an afterthought.

This Security Statement explains the technical and organisational measures we use to protect data processed through the Qiq platform and related services (the “Services”). It should be read together with our Privacy Policy, Terms of Service, Cookie Policy and Data Processing Addendum (DPA).

Contact Details

• Legal entity: Qiq LLC
• Address: 809 Cuesta Dr Ste B, Mountain View, CA 94040, USA
• General security email: security@qiq.one
• Privacy email: privacy@qiq.one

Scope

This Security Statement covers the Qiq main website (qiq.one), the Qiq Smart platform and related online services, infrastructure, and supporting systems that we operate or control. For clarity:

• In scope: production infrastructure, application code, databases, backups, monitoring, and internal tools used to support the Services.
• Out of scope: third-party websites or services that you access from Qiq (for example, external payment pages or integration partners), which are governed by their own security and privacy practices.

Current applicability: controls in this statement apply where implemented for a live Qiq component. Before a SaaS component launches, references to its accounts, databases, backups and production controls describe launch requirements rather than a representation that every optional control is already active.

Infrastructure & Hosting

Qiq is hosted on reputable cloud providers with strong physical and environmental controls, redundancy, and compliance programmes. We use separate environments for development, staging and production where applicable, and restrict access between these environments.

• Production systems are hosted in modern data centres with strong physical controls, continuous monitoring and access logging.
• We use infrastructure-as-code and configuration management to make environments reproducible and auditable.
• Only authorised personnel can access production systems, and access is granted strictly on a need-to-know basis.

Data Protection & Encryption

We use encryption to protect customer data both in transit and at rest:

• In transit: Public Qiq endpoints use HTTPS with publicly trusted TLS certificates. Certificate validation level and issuer may vary by hostname and deployment; HSTS is enabled where supported by the active edge configuration.
• At rest: Databases, storage volumes and backups in our production environment are encrypted using strong industry-standard algorithms provided by our cloud providers.
• Secrets: Application secrets and keys are stored in dedicated secret management systems or encrypted configuration, and access to them is strictly controlled and logged.

Access Control & Authentication

Access to production systems and customer data is minimised and controlled:

• Least privilege: Access is granted based on role and limited to what is necessary to operate and improve the Services.
• Strong authentication: Administrative access to production systems requires strong authentication and, where supported, multi-factor authentication (MFA).
• Account security: We provide security-focused features such as secure password requirements, session management, and rate limiting to protect customer accounts.
• Access reviews: We periodically review access rights and revoke access when it is no longer required.

Application Security & Development Practices

Qiq follows a “secure by design” and “secure by default” approach during development:

• Secure coding: We follow secure coding guidelines and review changes via version control, code review and testing workflows.
• Dependencies: Third-party libraries and dependencies are monitored for known vulnerabilities, and updates are applied regularly.
• Environment separation: Risky changes are validated in non-production environments before deployment.
• Change management: We use structured deployment processes with logging and rollback capabilities.

Network & Perimeter Security

We use a multi-layered approach to protect our network perimeter and internal services:

• Firewalls, security groups and access control lists restrict inbound and outbound traffic to what is necessary for the Services.
• Where applicable, we use web application firewalls (WAF), DDoS protection and rate limiting to mitigate common attacks.
• Administrative interfaces and internal services are not directly exposed to the public internet where this can be avoided.

Logging, Monitoring & Alerting

Qiq maintains logs and monitoring for critical systems and security-relevant events:

• We log key application and infrastructure events, including authentication attempts, access to sensitive operations and system errors.
• Monitoring and alerting are configured to detect anomalous behaviour, performance degradation and security-relevant events.
• Logs are protected from unauthorised tampering and retained for an appropriate period consistent with our legal and operational needs.

Backups & Business Continuity

We maintain backups and continuity plans to help ensure that the Services remain available and that data can be restored in the event of an incident:

• Customer data is backed up regularly and stored in encrypted form.
• We periodically test our ability to restore from backups.
• Our infrastructure is designed to avoid single points of failure where reasonably possible.

Subprocessors & Third-Party Services

We use carefully selected subprocessors and third-party services to deliver the Qiq platform. These providers may process customer data on our behalf in accordance with our instructions.

• We perform due diligence on key providers with a focus on security and reliability.
• We maintain written agreements with subprocessors that include appropriate data protection and security obligations.
• Our main infrastructure and payment partners are described in our DPA and related documentation.

Email Security & Anti-Abuse Measures

We take measures to protect email communications and to reduce abuse of our platform:

• We implement SPF, DKIM and DMARC records to help prevent spoofing of Qiq email domains.
• Transactional and notification emails are sent through reputable email providers with appropriate security controls.
• We monitor for patterns of abuse, spam or fraudulent activity and may suspend or limit accounts that violate our Terms of Service.

International Data Transfers

As described in our Privacy Policy and DPA, customer data may be processed in countries outside your own, including the United States and other jurisdictions where our infrastructure or subprocessors are located.

Where required, we rely on appropriate transfer mechanisms, such as Standard Contractual Clauses (SCCs) or equivalent frameworks, and we implement additional safeguards where appropriate.

Customer Responsibilities

Security is a shared responsibility. While Qiq is responsible for the security of the platform, customers are responsible for:

• Choosing strong, unique passwords and enabling additional security features where available.
• Managing access to their accounts and ensuring that only authorised individuals are given access.
• Configuring the Services in a secure way that matches their risk profile and compliance requirements.
• Reviewing activity logs and account settings for signs of misuse.

Personnel & Confidentiality

We limit internal access to customer data to personnel who need it to operate, support or improve the Services.

• Staff with access to customer data are bound by confidentiality obligations.
• We provide security awareness and privacy training appropriate to roles and responsibilities.
• Access is revoked when personnel change role or leave the organisation.

Responsible Disclosure & security.txt

We welcome responsible disclosure of vulnerabilities. If you believe you have found a security issue in Qiq, please contact us at security@qiq.one and provide enough detail to help us reproduce and assess the issue.

• We ask that you do not publicly disclose the issue until we have had a reasonable opportunity to investigate and address it.
• Please avoid actions that could disrupt the Services, access other customers’ data, or cause harm.
• Further details, including our PGP public key and acknowledgements, are available via our security.txt file at https://qiq.one/.well-known/security.txt.

Incident Response

We maintain processes for detecting, investigating and responding to potential security incidents:

• Suspected incidents are triaged and investigated by authorised personnel.
• We take steps to contain, mitigate and remediate confirmed incidents.
• Where required by law or contract, we notify affected customers and regulators without undue delay.

Compliance & Legal Basis

Our security measures are designed to support compliance with applicable data protection and privacy laws, including the EU/EEA General Data Protection Regulation (GDPR) where it applies to our processing of personal data.

Specific details about our roles as controller and processor, as well as legal bases for processing, are described in our Privacy Policy and DPA.

Third-Party Links & Integrations

The Qiq platform may allow you to connect to third-party services or follow links to external websites. These services and websites are not operated or controlled by Qiq, and their security and privacy practices may differ from ours.

We encourage you to review the security and privacy information of any third-party service or integration before enabling it for your account.

Changes to This Security Statement

We may update this Security Statement from time to time, for example to reflect improvements to our practices, changes in technology or updates to legal requirements.

When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, provide additional notice (for example, via the Qiq dashboard or by email).

Contact Us

If you have questions about this Security Statement or Qiq’s security practices, you can contact us at:

• Email: security@qiq.one
• General contact: info@qiq.one
• Postal: Qiq LLC, 809 Cuesta Dr Ste B, Mountain View, CA 94040, USA

This Security Statement should be read together with our Privacy Policy, Terms of Service, Cookie Policy and Data Processing Addendum (DPA).