Qoolo

Security at Qoolo:
Protecting your data,
safeguarding your trust

Welcome to Qoolo's Security Hub. We understand that trust is an important part of your decision to build a relationship with Qoolo. We provide cutting-edge SaaS solutions and medical content to the life sciences industry, so our commitment to compliance and information security is a top priority.

Our compliance
frameworks

To ensure the highest levels of protection for our customers, Qoolo aligns its information security program with industry-leading standards and regulations. We continually refine our policies, procedures, and technical safeguards to meet or exceed the following requirements:

HIPAA
GDPR
CCPA

By adopting these frameworks, we deliver assurance that our products, services, and internal processes are systematically designed to protect your organization’s sensitive information.

Infrastructure Security & Hosting

Qoolo is hosted on Amazon Web Services (AWS), leveraging its secure global infrastructure to provide reliable and scalable service.

AWS Serverless Architecture: Our serverless and autoscalling approach ensures that we can handle variable workloads efficiently while maintaining robust security guardrails.

Global CDN: To optimize performance and maintain swift, secure access worldwide, we utilize a global content delivery network for all static assets.

Multi-Tenant Environment: Customer data is logically separated, with strict role-based access to prevent cross-tenant data exposure.

Data Encryption & Privacy

We take a privacy-first approach, ensuring all data is protected through advanced encryption and secure handling procedures.

Encryption at REST: Data is encrypted using AES 256-bit algorithms.

Encryption in Transit: We use TLS 1.2+ protocols to protect data moving across networks.

HIPAA, GDPR, and CCPA Compliance: We maintain regulatory controls and processes that address global privacy requirements, protecting personal health information and other sensitive data.

Access Control

We deploy role-based access control (RBAC) to enforce the principle of least privilege, ensuring that only authorized personnel can access critical systems and data.

Granular Permissions: Permissions are granted based on a user's role, limiting exposure to sensitive data or system features.

Secure Onboarding & Offboarding: We provision and revoke access as employees, contractors, or vendors join or leave the organization.

Monitoring & Auditing: All access requests and changes are logged, monitored, and periodically reviewed for suspicious activity.

Organizational Security & Operations

Our commitment to security is reflected in how we manage our teams, our infrastructure, and our day-to-day operations:

Security Awareness Training: All Qoolo employees undergo annual security training, reinforcing best practices and compliance requirements.

Change Management: Every code and infrastructure change is tracked and tested before deployment to prevent unauthorized adjustments and ensure stability.

Vendor Risk Assessments: Before integrating with third-party tools or partners, we thoroughly evaluate their security posture.

Disaster Recovery & Business Continuity: We conduct annual tests of our disaster recovery and continuity processes to validate that our systems can recover quickly after an incident.

Testing & Vulnerability Management

We proactively identify and mitigate risks through ongoing assessment of our platform and environment:

Third-Party Penetration Testing: Independent security experts conduct annual penetration tests to uncover and address potential weaknesses.

Continuous Vulnerability Scanning: We use automated tools to detect vulnerabilities in real-time, enabling quick remediation.

Risk-Based Prioritization: Potential threats are prioritized according to severity, allowing us to focus resources on the most critical issues first.

Security is only part of the story

From day one, Qoolo has been built around the expectations of life sciences companies, helping teams work with confidence in regulated environments.

Explore the Qoolo Platform

Have a Security Question?

Our security team is ready to answer your questions, provide additional documentation to support your security assessment, or receive vulnerability disclosures.

Contact us

The answers you're looking for:

Yes. Our information security program is aligned with HIPAA, GDPR, and CCPA, and we continually refine our policies, procedures, and technical safeguards to meet or exceed those requirements. That covers personal health information handling, EU data subject rights, and California consumer privacy. Compliance is reflected in how we build, host, and operate Qoolo day to day, from encryption and access control through vendor management and audit logging. This extends to how we use AI: it's designed to assist, not replace, human judgment, and content still moves through the appropriate review, approval, and compliance processes before use.

Qoolo is hosted on Amazon Web Services (AWS), using a serverless and autoscaling architecture that handles variable workloads efficiently while maintaining strong security guardrails. We use a global content delivery network for static assets to keep performance fast and access secure worldwide. Data residency is available in the US or EU depending on customer location.

The platform runs in a multi-tenant environment with logical separation of customer data (through customer-specific identifiers) and strict role-based access, so one customer's content, references, or analytics are never exposed to another. Development, staging, and production environments are kept separate, and customer data is never stored in non-production environments. Customers requiring enhanced isolation can be configured with dedicated network and infrastructure arrangements at the enterprise level.

All customer data in Qoolo is encrypted at rest using AES 256-bit algorithms, and all data moving across networks is protected with TLS 1.2 or higher, applying to content, references, analytics, and any personal data we handle. We pair encryption with strict access controls, audit logging, and the privacy frameworks we align with (HIPAA, GDPR, CCPA), so data is protected both technically and procedurally.

Access to customer data in Qoolo is governed by role-based access control (RBAC) and the principle of least privilege. We grant users only the level of access they need to do their job. Permissions are granular, exposure to sensitive data or system features is limited to authorized roles, and we provision and revoke access for employees, contractors, and vendors through formal onboarding and offboarding processes.

We log, monitor, and periodically review all access requests, changes, and activity for suspicious behavior. Production access requires multi-factor authentication, and customers can scope permissions inside the platform by brand, market, or team.

We run continuous automated vulnerability scanning across the platform and infrastructure, so issues are surfaced and remediated quickly. Independent third-party experts also conduct annual penetration tests to identify weaknesses our internal tools and processes might miss.

Findings are prioritized by severity. We address critical issues first and handle lower-severity items within defined timeframes. Patches are deployed through development, staging, and production on a regular cadence, alongside ongoing monitoring and logging for suspicious activity.

All Qoolo employees complete security awareness training when they join and annually after that. Policies cover acceptable use, secure development, access management, and incident response. Code and infrastructure changes go through formal change management, tracked, reviewed, and tested before deployment, so unauthorized or untested changes do not reach production.

Third-party vendors are evaluated before integration through vendor risk assessments, and their service delivery is monitored and reviewed on an ongoing basis. Written agreements require vendors to maintain confidentiality, integrity, availability, and privacy controls consistent with our information security program.

The Security page includes a "CONTACT US" option that reaches our security team directly, which is the fastest way to request documentation, completed questionnaires, or support with a vendor security review. Additional detail on specific controls, frameworks, or integration scenarios is available on request.

For ongoing customers, our security team is available through the assigned account contact for any follow-up assessments or audit support.