Security at Qik

Organisations use Qik to hold information about the people they serve, often including children and families. This page explains, in plain terms, how we look after that information. For the legal detail of what we collect and how it may be used, see our Privacy Policy.

Where your data is stored

All customer data is stored in Australia.

• Application hosting: Amazon Web Services (AWS), Sydney region (ap-southeast-2).

• Database: a dedicated MongoDB Atlas cluster, also on AWS in Sydney, reached from our servers over a private network link.

• Uploaded files: Amazon S3 in the same region.

• Monitoring logs: Grafana Cloud, in Australia.

Some features rely on services based overseas:

• Qikbot, the AI assistant in the dashboard, sends the content it needs to answer a question to Anthropic in the United States. It only does this when someone uses it, and it can only see what that person can already see. An administrator can switch it off with the AI setting.

• Other AI features, such as automatic image tagging, are off unless an organisation turns them on.

• SMS messages are delivered by Bird (European Union) when an organisation sends text messages.

• Mobile push notifications are delivered through Google's Firebase service.

Neither we nor our AI provider use your data to train AI models.

Encryption

• In transit: every connection to Qik uses TLS (HTTPS). Plain HTTP is redirected to HTTPS.

• At rest: the database, backups and file storage are encrypted at rest using the built-in encryption of MongoDB Atlas and AWS, with keys managed by their key-management services.

• Passwords are never stored in plain text, and files marked secure are served through short-lived signed links.

Signing in

• Two-factor authentication is required for every email-and-password sign-in to the Qik dashboard, and can't be turned off.

• People can also sign in with Apple or Google, in which case that provider's own sign-in and two-factor protections apply.

• For apps and websites that organisations build on Qik for their own members, two-factor authentication can be switched on per app.

Who can see what

• Every record belongs to one organisation, and that is checked on every request. One organisation can never see another's data.

• Within an organisation, access is controlled by the roles and permissions its administrators set up, down to individual fields.

• The Qikbot assistant acts as the signed-in person and can only see and do what that person already can.

• Access to our production systems is limited to the core Qik team, on a least-privilege basis. We only look at customer data when it's needed to provide support or keep the service running.

Change history and recovery

Every change to a record in Qik is kept as part of its history. Your team can see who changed what and when, view a record as it was at an earlier point in time, and roll a record back to a previous version. Deleted records go to a trash and can be restored. Most mistakes can be put right by your own administrators, without needing us to restore a backup.

Behind that:

• The database runs as a three-node replica set, so it keeps running if one node fails.

• Full database backups are taken every hour and kept for 24 hours, alongside daily and weekly backups, so restore points go back about a month.

• Application servers run behind a load balancer across more than one instance and are replaced automatically if one fails.

We don't currently offer a contractual uptime commitment (SLA).

Security testing and monitoring

• We engage external penetration testers. Their reports are kept confidential, and the issues they identify are fixed as a priority.

• We also review our code for security on an ongoing basis.

• Servers sit behind a web application firewall and are patched regularly, and the database isn't exposed to the public internet.

• We keep server access logs for security monitoring.

Payments

Card payments are handled by Stripe, currently the only payment processor Qik supports. Card details go directly from the payer to Stripe and never pass through or get stored on Qik's servers.

If something goes wrong

If a data breach affects your organisation, we'll notify you without undue delay and in any event within 72 hours of becoming aware of it, and support you with any assessment and notification under the Notifiable Data Breaches scheme.

Keeping and deleting data

• Your organisation controls its data, and can delete or permanently erase records at any time.

• If you close your account, your data is deleted within 90 days, and backups roll over within about 4 weeks after that.

• We can provide an export of your data before you leave.

• Server logs are rotated after about 30 days.

Certifications and compliance

Qik follows the Australian Privacy Principles under the Privacy Act 1988. Our infrastructure providers (AWS, MongoDB Atlas and Stripe) hold SOC 2 and ISO 27001 certification, and Stripe is PCI DSS Level 1 certified, for the parts of the service they run.

Qik itself does not currently hold SOC 2 or ISO 27001 certification. These audits are designed for large enterprise procurement and typically cost $50,000 to $100,000 or more a year to achieve and maintain, which isn't proportionate for the organisations we serve. HIPAA is a US health-data law and doesn't apply to Qik.

Third parties

The full list of third parties that process data on our behalf, and where, is in the Sub-Processors section of our Privacy Policy.

Questions

If your board, auditor or IT team needs more detail, or a data processing agreement, email support@qik.dev.