Security

HqO maintains a comprehensive information security management system (ISMS) built on ISO 27001 and NIST framework best practices, and continuously improves it as the business grows. This page describes HqO's security controls, organized by the ISO/IEC 27001:2022 control themes: Organizational, People, Physical, and Technological.

For privacy, data handling, and your rights under GDPR, CCPA, and PIPEDA, see the Privacy page.

Last updated: August 2026

Frameworks and Certifications

ISO 27001:2022. HqO is ISO 27001:2022 certified. The certification, issued by an accredited independent certification body, covers the ISMS supporting the confidentiality, integrity, and availability of customer data, supplier information, and HqO's internal data related to developing, operating, and planning the workplace experience platform. The current certificate is available to download from our Trust and Security page.

SOC 2 Type II. SOC 2 is an attestation report, not a certification, so there is no such thing as being SOC 2 certified. HqO has completed a SOC 2 Type II examination performed by an independent third-party auditor. The resulting report describes the controls HqO has established to support its operations and compliance, and is available upon request.

CSA STAR Level 1. HqO maintains a Cloud Security Alliance (CSA) STAR Level 1 self-assessment (CAIQ v4.0.2), which documents HqO's security practices and is published on the CSA STAR Registry.

HqO also aligns its solution with data protection laws and regulations in the regions where its customers reside, including GDPR, CCPA, and PIPEDA.

Organizational Controls

Security Policies and Governance

HqO maintains a comprehensive set of security policies and procedures that are communicated and accessible to all employees. Policies and procedures are reviewed at least annually, and HqO performs tests and compliance checks to confirm the controls operate effectively.

Risk Management

HqO conducts an Information Security Risk Assessment at least annually, aligned to the NIST Cybersecurity Framework. Identified risks are treated and tracked as part of the ISMS.

Access Governance

Access management follows least-privilege and need-to-know principles.

Role-Based Access Control (RBAC) limits user permissions to what each role requires
Privileged Access Management monitors and controls administrative accounts
User access is reviewed regularly to confirm that permissions remain appropriate

Supplier and Third-Party Security

HqO operates a vendor management program that defines the requirements agreed upon when engaging third parties. All third-party integrations go through HqO's vendor risk assessment process before onboarding, and vendors are reassessed at least annually. Vendors are evaluated on their security certifications, data handling practices, and encryption, and are required to sign data protection agreements. Data exchanged with vendors is encrypted using TLS. A complete list of sub-processors is maintained in the Data Processing Addendum on the Legal Hub.

Incident Management

HqO maintains comprehensive incident response policies and procedures, including defined communication channels and methodology for notifying customers and regulators. In the event of a personal data breach, affected customers are notified without undue delay in line with the terms of their Data Processing Addendum and applicable law. The incident response procedure is tested at least annually.

Business Continuity and Disaster Recovery

HqO maintains a Business Continuity and Disaster Recovery Plan covering system failures, cyberattacks, and natural disasters. It relies on geographically redundant AWS infrastructure, trained response teams (Incident Response, Engineering, IT, Communications), and predefined communication protocols. The plan is tested at least annually, and post-incident reviews refine future response. Customer Success teams provide direct client updates during incidents. HqO's service availability objective is published on the SLA page.

People Controls

Screening and Confidentiality

Where permitted by local law, HqO conducts background checks on new hires as part of onboarding. All employees are bound by confidentiality and data protection obligations through signed employment agreements.

Security Awareness and Training

During onboarding and at least annually thereafter, employees are required to read and acknowledge HqO's security policies and procedures. HqO plans, runs, and continuously improves company-wide security awareness campaigns so that employees understand security best practices and how to protect customer and business information.

Individual Accountability and Access Lifecycle

All employees sign in with individual accounts, and shared logins are not permitted. Access is granted based on role, reviewed regularly, and revoked automatically through HR offboarding workflows. All login and access activity is logged.

Physical Controls

Office Security

HqO offices are secured with badge-controlled access, surveillance cameras, and access logging. Because no customer or personal data is stored or processed at HqO offices, the offices are not part of the data hosting environment.

Data Center Security (AWS)

HqO does not operate its own data centers. All customer data is hosted on Amazon Web Services (AWS) in the US East region (Northern Virginia) and the EU Central region (Frankfurt, Germany). Under the AWS shared responsibility model, AWS manages the physical security of these facilities, which meet Tier 3+ standards including biometric access controls, mantraps, 24/7 surveillance, and intrusion detection.

Technological Controls

Encryption

Data at rest uses AES-256 encryption, and TLS 1.2+ protects data in transit. These protocols extend to backups, logs, and sensitive email communications.

Data Hosting and Availability

Customer data is hosted on AWS in Northern Virginia (US East) and Frankfurt (EU Central). Primary instances are replicated in real time to secondary instances across multiple availability zones to ensure high availability. Infrastructure, application deployment, and connected services are all provisioned with code, which improves recoverability in the event of disruption.

Authentication

For end users, HqO supports username and password at a minimum, as well as Single Sign-On (SSO) through the SAML protocol. For internal access to company systems, HqO enforces SSO via Okta and multi-factor authentication. Failed login attempts are tracked in real time. After multiple failures, accounts are temporarily locked and the security team is alerted via AWS and Slack, and patterns are analyzed to identify persistent threats.

Endpoint and Mobile Device Security

HqO enforces its mobile device management (MDM) policy via JAMF Pro on all company-managed Apple devices. Requirements include encryption, password protection, and remote wipe. Non-compliant and unauthorized devices are blocked from accessing company systems.

Logging and Monitoring

HqO logs login attempts, data access events, configuration changes, and system errors. Logs are encrypted at rest and in transit, and only authorized personnel can access them. Real-time analysis flags suspicious activity, and retention periods comply with GDPR and auditing requirements.

Anti-Malware and Vulnerability Management

HqO uses JAMF-managed anti-malware tools for threat detection, automatic updates, and regular scans. Vulnerability scanning of the production environment is performed every two weeks using a third-party solution, and an external party performs an annual penetration test on HqO's web and mobile applications and infrastructure. Identified observations are prioritized by risk severity, tracked, and resolved according to policy.

Environment Separation

Production, staging, and development environments run on separate AWS accounts. Personal data is only processed in production, and synthetic data is used in non-production environments. Access to each environment is role-based, logged, and audited.

Customer Data Segregation

HqO operates a multi-tenant platform. Customer data is logically segregated within the production environment so that each customer's data is isolated and accessible only within that customer's authorized context. Application-level access controls enforce this separation on every request.

Backups and Redundancy

HqO uses AWS native tools to create encrypted database snapshots at five-minute intervals. Backups are retained for 30 days and stored across multiple AWS regions. Restoration of backup data is tested regularly.

API Security

All API traffic uses TLS encryption. Endpoints authenticate via secure tokens. Rate limiting prevents abuse and denial-of-service attacks.

Secure Development and Remediation

HqO follows a secure development lifecycle. Before release, changes go through manual and automated testing, including unit, end-to-end, and functional tests, supplemented by third-party testing. Production is continuously monitored to detect issues in the field. Reported and detected issues are triaged, prioritized by severity, and tracked to resolution. High-priority fixes are validated in a staging environment and require senior engineering sign-off before deployment to production.

Responsible Disclosure

If you believe you have found a security vulnerability in HqO's products or infrastructure, please report it to security@hqo.co. HqO investigates all reports and will work with the reporter on remediation.

Contact

For security questions, email security@hqo.co or visit Trust and Security.

Privacy — data handling and individual rights