The IQ Platform
The IQ Platform
Security Policy
1. Purpose and scope
The IQ Platform Ltd is committed to protecting the confidentiality, integrity and availability of information processed by The IQ Platform.
This policy applies to The IQ Platform software, supporting services and infrastructure operated by The IQ Platform Ltd, and to personnel and contractors who are authorised to administer those systems. Customer-managed infrastructure, networks, operating systems and third-party services remain subject to the customer's own security responsibilities and the terms of the relevant provider.
Security is a shared responsibility. The IQ Platform Ltd provides security controls within the product and its operated services; customers are responsible for deploying, configuring and operating the platform appropriately for their environment.
2. Security principles
We use a risk-based approach to security. Controls are selected according to the sensitivity of information, the role of a system, credible threats, operational requirements and the potential impact of a security event.
Core principles include least privilege, defense in depth, secure defaults where practical, separation of administrative responsibilities, traceability of significant administrative actions, timely maintenance, minimisation of unnecessary data exposure, and recovery planning.
3. Identity and access control
Access to The IQ Platform is controlled through authenticated user identities and role/permission mechanisms appropriate to the function being accessed.
Administrative functions should be restricted to authorised personnel. Permissions should be granted according to operational need and reviewed when a person's role or responsibilities change. Where supported and configured, organisations may use external identity or single sign-on services. Customers remain responsible for the security of their identity provider, user lifecycle and authentication policies.
Credentials, tokens, API keys and other secrets must not be deliberately exposed in user interfaces, logs, support material or source-control repositories.
4. Data protection
The IQ Platform is designed to limit access to information according to authorised application context and permissions. Information should be collected, stored and retained only where there is a legitimate product, operational, contractual or legal purpose.
Appropriate technical measures may include encryption in transit, access controls, audit records, secure secret handling, database protections and operating-system controls. The exact controls available depend on deployment architecture and customer configuration.
Customers are responsible for classifying the information they place into the platform, defining suitable retention periods, protecting backups and configuring access appropriate to their legal and organisational requirements.
5. Encryption and communications
Network communications should use secure protocols where supported and appropriate. HTTPS/TLS should be used for browser and service communications that traverse untrusted networks. Certificates and private keys must be protected and renewed or replaced as required. Customer-managed certificates, firewalls, network segmentation, VPNs and related infrastructure remain the customer's responsibility unless explicitly supplied as a managed service. Legacy or third-party protocols may have different security capabilities. Their use should be evaluated against the risks of the deployment environment.
6. Application and software security
Security is considered during design, implementation, testing, release and maintenance of The IQ Platform. Development practices include source control, controlled changes, code review or equivalent review processes, automated testing where appropriate, dependency management, release validation and separation between development changes and formal release artifacts.
Security-sensitive changes should be scoped, reviewed and tested according to their risk. Production releases should be generated through controlled build and deployment processes.
7. Third-party and open-source software
The IQ Platform uses third-party and open-source technologies. Dependencies are selected for legitimate product purposes and should be maintained at versions appropriate to the supported platform.
Security advisories and material dependency risks are considered as part of maintenance. The timing and method of an update may depend on severity, exploit-ability, compatibility, operational impact and the availability of a suitable upstream fix.
Third-party products and customer-configured integrations remain subject to their providers' security practices and terms.
8. Vulnerability management
Reported or identified vulnerabilities are assessed according to their potential impact, likelihood of exploitation, affected versions and available mitigations.
Confirmed vulnerabilities may be addressed through software updates, configuration guidance, mitigations, dependency updates or other appropriate measures. Remediation priority is risk-based rather than determined solely by a published severity score.
We do not guarantee that software will be free from all vulnerabilities. Security is an ongoing process and customers should keep supported software current and follow published security guidance.
9. Security updates and supported versions
Customers should deploy supported versions and security-related updates within a time frame appropriate to their environment and risk.
Older releases may not receive the same level of maintenance as current supported releases. Where a security issue is corrected in a newer supported release, upgrading may be the required remediation.
Customers should maintain a tested backup and recovery path before significant upgrades and follow The IQ Platform deployment guidance.
10. Logging, audit and monitoring
The IQ Platform may record operational, security and administrative events to support troubleshooting, accountability, service operation and security investigation.
Audit and diagnostic information should avoid unnecessary exposure of credentials and secrets. Access to logs and diagnostic information should be limited to personnel who require it.
Customers are responsible for any external monitoring, SIEM integration, operating-system logs, network monitoring and retention requirements outside the controls supplied by the platform.
11. Infrastructure and deployment security
The IQ Platform may be deployed in customer-controlled, hosted or other supported environments. Security responsibilities vary with the deployment model.
Customers managing their own infrastructure are responsible for operating-system security, physical security, network controls, database administration where applicable, endpoint protection, backup security and restricting administrative access.
Default or example passwords must be changed before production use. Unnecessary services and network exposure should be disabled or restricted.
12. Backups, resilience and recovery
Customers should maintain backups appropriate to the importance of their service and should test recovery procedures periodically.
Where The IQ Platform provides resilience, federation or recovery features, those features complement rather than replace a documented customer backup and disaster-recovery plan.
Backup copies must be protected against unauthorised access and, where practical, against modification or deletion by the same credentials used for day-to-day production administration.
13. Personnel and administrative access
Access by The IQ Platform Ltd personnel to production or customer information should be limited to legitimate support, maintenance, security or service-delivery purposes and to personnel authorised for that work.
Administrative access should use individual identities where practical, be limited to the access required, and be removed when no longer necessary.
Personnel are expected to protect confidential information and report suspected security incidents promptly.
14. Security incident response
Suspected security incidents affecting systems operated by The IQ Platform Ltd are assessed, contained and investigated according to their nature and severity.
Response activities may include preservation of relevant evidence, containment, credential or key rotation, remediation, recovery, increased monitoring and communication with affected parties.
Where The IQ Platform Ltd determines that notification is required by applicable law or contractual obligation, notifications will be made in accordance with those requirements.
15. Responsible vulnerability reporting
We welcome good-faith reports of potential security vulnerabilities affecting The IQ Platform.
Security reports should include sufficient detail to reproduce and assess the issue, such as the affected product/version, relevant configuration, steps to reproduce, observed impact and any supporting evidence.
Researchers should avoid privacy violations, disruption, destruction of data, social engineering, denial-of-service testing, accessing information beyond what is necessary to demonstrate the issue, or public disclosure before The IQ Platform Ltd has had a reasonable opportunity to investigate and address a confirmed vulnerability. Until a dedicated security contact is published, reports may be submitted through the official support/contact channel listed on The IQ Platform website.
16. Customer responsibilities
Customers are expected to protect administrator accounts, apply appropriate access permissions, keep supported software current, secure their infrastructure, maintain backups, protect secrets and certificates, and review configuration before exposing services to public or untrusted networks.
Customers should remove access promptly when users leave or change roles and should investigate unexpected account, audit or system activity.
Security features cannot compensate for compromised host systems, insecure networks, shared credentials, intentionally weakened configuration or unsupported third-party components.
17. Privacy and security
Security and privacy are related but distinct. The handling of personal information is described separately in The IQ Platform privacy documentation. This security policy does not replace contractual data-processing terms, privacy notices or customer obligations under applicable privacy and data-protection law.
18. Business continuity and availability
We design and operate security controls with service availability in mind. However, no software, network or hosted service can guarantee uninterrupted availability.
Maintenance, dependency failures, internet outages, customer infrastructure failures, cyber incidents and events outside reasonable control may affect service availability. Customers with critical operational requirements should design appropriate local resilience and recovery arrangements.
19. Security assurance and limitations
The security controls described in this policy represent general practices and objectives. Specific controls may differ by product module, deployment type, license, configuration and service arrangement. Unless explicitly stated in a separate written agreement, publication of this policy does not represent certification against a particular security standard and should not be interpreted as a guarantee of absolute security.
We may improve or modify security controls as threats, technology, regulatory requirements and the platform evolve.
20. Policy review and changes
This policy is reviewed periodically and may be updated to reflect material changes to The IQ Platform, its security practices, applicable requirements or the threat environment.
The current published version should identify its effective or revision date. Material changes may be communicated through appropriate product, website or customer channels.
Effective: 1st October 2026
Last Updated: 12th October 2026