Question 1

Is Qoolo HIPAA, GDPR, and CCPA compliant?

Accepted Answer

Yes. Our information security program is aligned with HIPAA, GDPR, and CCPA, and we continually refine our policies, procedures, and technical safeguards to meet or exceed those requirements. That covers personal health information handling, EU data subject rights, and California consumer privacy. Compliance is reflected in how we build, host, and operate Qoolo day to day, from encryption and access control through vendor management and audit logging. This extends to how we use AI: it's designed to assist, not replace, human judgment, and content still moves through the appropriate review, approval, and compliance processes before use.

Question 2

Where is Qoolo hosted, and what is the infrastructure model?

Accepted Answer

Qoolo is hosted on Amazon Web Services (AWS), leveraging its secure global infrastructure to provide reliable and scalable service.

AWS Serverless Architecture: Our serverless and autoscalling approach ensures that we can handle variable workloads efficiently while maintaining robust security guardrails.

Global CDN: To optimize performance and maintain swift, secure access worldwide, we utilize a global content delivery network for all static assets.

Multi-Tenant Environment: Customer data is logically separated, with strict role-based access to prevent cross-tenant data exposure.

The platform runs in a multi-tenant environment with logical separation of customer data (through customer-specific identifiers) and strict role-based access, so one customer's content, references, or analytics are never exposed to another. Development, staging, and production environments are kept separate, and customer data is never stored in non-production environments. Customers requiring enhanced isolation can be configured with dedicated network and infrastructure arrangements at the enterprise level.

Question 3

How is customer data encrypted?

Accepted Answer

All customer data in Qoolo is encrypted at rest using AES 256-bit algorithms, and all data moving across networks is protected with TLS 1.2 or higher, applying to content, references, analytics, and any personal data we handle. We pair encryption with strict access controls, audit logging, and the privacy frameworks we align with (HIPAA, GDPR, CCPA), so data is protected both technically and procedurally.

Question 4

How does Qoolo control access to customer data?

Accepted Answer

Access to customer data in Qoolo is governed by role-based access control (RBAC) and the principle of least privilege. We grant users only the level of access they need to do their job. Permissions are granular, exposure to sensitive data or system features is limited to authorized roles, and we provision and revoke access for employees, contractors, and vendors through formal onboarding and offboarding processes.

We log, monitor, and periodically review all access requests, changes, and activity for suspicious behavior. Production access requires multi-factor authentication, and customers can scope permissions inside the platform by brand, market, or team.

Question 5

How does Qoolo test for vulnerabilities?

Accepted Answer

We run continuous automated vulnerability scanning across the platform and infrastructure, so issues are surfaced and remediated quickly. Independent third-party experts also conduct annual penetration tests to identify weaknesses our internal tools and processes might miss.

Findings are prioritized by severity. We address critical issues first and handle lower-severity items within defined timeframes. Patches are deployed through development, staging, and production on a regular cadence, alongside ongoing monitoring and logging for suspicious activity.

Question 6

How are Qoolo employees and vendors held to security standards?

Accepted Answer

All Qoolo employees complete security awareness training when they join and annually after that. Policies cover acceptable use, secure development, access management, and incident response. Code and infrastructure changes go through formal change management, tracked, reviewed, and tested before deployment, so unauthorized or untested changes do not reach production.

Third-party vendors are evaluated before integration through vendor risk assessments, and their service delivery is monitored and reviewed on an ongoing basis. Written agreements require vendors to maintain confidentiality, integrity, availability, and privacy controls consistent with our information security program.

Question 7

Where can our security or procurement team get more documentation about Qoolo?

Accepted Answer

The Security page includes a "CONTACT US" option that reaches our security team directly, which is the fastest way to request documentation, completed questionnaires, or support with a vendor security review. Additional detail on specific controls, frameworks, or integration scenarios is available on request.

For ongoing customers, our security team is available through the assigned account contact for any follow-up assessments or audit support.

Security at Qoolo:
Protecting your data,
safeguarding your trust

Our compliance
frameworks

Infrastructure Security & Hosting

Data Encryption & Privacy

Access Control

Organizational Security & Operations

Testing & Vulnerability Management

Security is only part of the story

Have a Security Question?

The answers you're looking for:

Security at Qoolo:Protecting your data, safeguarding your trust

Our complianceframeworks