Security controls

Scope and status

This page covers the OKQ Solutions platform and the processing of personal data and Subscriber Input submitted through it. It does not cover corporate systems outside the platform, which are addressed separately.

OKQ Solutions AB is an early-stage company completing platform development ahead of onboarding its first client. This page distinguishes controls in place today from controls in active development. It is company-owned content, not an independent certification such as SOC 2 or ISO 27001.

Encryption in transit → In place

• Traffic between browsers or client applications and our servers is protected by TLS 1.2 or higher.
• API endpoints and database connections use encrypted connections.
• Encryption of internal service-to-service communication is being extended as new services are added.

Encryption at rest → In place

• Data held in databases and storage systems is encrypted using AWS-managed encryption and key handling.
• Passwords are hashed using an industry-standard algorithm with automatic salt generation.
• Passwords are never stored in plain text and cannot be recovered.

Access controls → Partly in place, expanding

• Postgres Row Level Security enforces isolation of tenant data at the database level.
• Access rights are reviewed by the founding team and revoked promptly when no longer needed.
• Only authorised personnel bound by confidentiality obligations can access personal data.
• Role-based access control across the full platform and multifactor authentication for administrative access are in development and will be enforced before general availability.

System resilience and availability → Build in progress

• The architecture uses managed services in the eu-north-1 Stockholm region for EU data residency and resilience.
• Resilient multi-instance deployment, defined backup recovery objectives, deployment rollback, and continuous health monitoring are being built ahead of first-client onboarding.

Security monitoring → In development

• Centralised security logging and monitoring is being built. Until it is live, the founding team manually reviews access to systems holding personal data.
• Once monitoring is operational, this page will describe log retention and anomaly-investigation processes.

Incident response → In development

• OKQ Solutions AB is developing a formal, documented incident-response process.
• Once adopted, processor-side breach notifications are intended without undue delay, targeting within 72 hours of awareness, consistent with Article 33 GDPR or any shorter contractual or legal timeframe.
• Where OKQ Solutions AB acts as controller and a breach is likely to result in high risk, affected data subjects are intended to be notified without undue delay, consistent with Article 34 GDPR.
• These intentions will become confirmed processes once the response plan is finalised and tested.

Staff oversight → In place, training in development

• Employees and contractors with access to personal data are bound by confidentiality obligations, including signed non-disclosure agreements.
• Access is granted on the principle of least privilege.
• A structured security-awareness training programme is in development for all staff and contractors before general availability.

Vendor and subprocessor oversight → In development

• OKQ Solutions AB is drafting its Data Processing Agreement and subprocessor-evaluation process.
• A current subprocessor list will be published once finalised. Contact us for the status of relevant subprocessor relationships during your evaluation.

Customer responsibilities

• Keep account credentials confidential.
• Enable multifactor authentication where available.
• Revoke administrator and end-user access promptly when no longer required.
• Report suspected unauthorised access immediately to our security contact.

Shared responsibility

OKQ Solutions AB is responsible for platform-level security controls described above. Subscribers are responsible for how the Services are configured and used within their organisation, including the lawful basis for any Input they upload.