At Quake, we are committed to protecting the confidentiality, integrity, and availability of our clients' data. Our Information Security Management System (ISMS) is aligned with ISO 27001 standards. This document outlines the technical and organisational measures we implement to secure the Quake Platform.
Hosting Providers: The Quake Platform infrastructure is hosted on AWS (Amazon Web Services) and Vultr. Both providers are Tier-1 cloud operators maintaining ISO 27001, SOC 2 Type II, and PCI-DSS compliance standards.
Data Locality: All production data is stored in the [e.g., London] region. We do not transfer data outside this region without explicit agreement.
Physical Access: We rely on our cloud providers' robust physical security (biometrics, 24/7 onsite security, video surveillance) and do not maintain physical servers at our own offices.
Encryption in Transit: All data transmitted between the Client and the Quake Platform is encrypted using strong protocols (TLS 1.2 or higher).
Encryption at Rest: Customer data is encrypted at rest within our AWS and Vultr storage volumes using industry-standard algorithms (AES-256).
Backups:
Frequency: Daily full backups and hourly incremental backups.
Redundancy: Backups are replicated to a separate geographic availability zone for disaster recovery.
Testing: Restoration procedures are tested annually.
Least Privilege: Internal access to production systems is restricted to a limited number of authorised engineering staff based on the principle of least privilege.
Multi-Factor Authentication (MFA): MFA is enforced for all Quake employees accessing internal systems, source code, and administrative dashboards.
Client Authentication: The Quake Platform supports secure authentication protocols including [e.g., SSO (Single Sign-On) or Enforced Strong Passwords].
Penetration Testing: We engage independent third-party security firms to conduct penetration testing on the Quake Platform at least annually. (Summary reports available upon request).
Vulnerability Scanning: Automated scans are performed on code dependencies and infrastructure regularly. Critical patches are applied within 14 days of release.
Secure Development: Our Software Development Life Cycle (SDLC) includes code reviews and static analysis (SAST) before deployment.
Monitoring: We utilise 24/7 automated monitoring across both AWS and Vultr environments to detect anomalous activity.
Notification: As per our Terms of Use, we commit to notifying clients of any confirmed Personal Data Breach without undue delay (and no later than 72 hours).
Response Plan: We maintain a documented Incident Response Plan (IRP) which is tested annually.
Screening: All Quake employees undergo background checks (including criminal record checks where legally permitted) prior to employment.
Training: All staff receive mandatory Information Security and GDPR training upon hire and annually thereafter.
Confidentiality: All employees and contractors sign strict confidentiality agreements (NDAs).
Client Attraction