Security and data protection

What needs to be clarified before a QAPP implementation.

This page describes the information and checks needed when preparing a proposal. It is not a security certification, a compliance guarantee or a service-level agreement.

Public website and application: different contexts

The qapp.ro presentation website is hosted by Hostico. The exact data location, providers, resources and responsibilities for a client implementation are confirmed in the proposal and contractual documents. We do not infer the application configuration from the public website configuration.

Access and traceability

The project defines users, roles, permissions, authentication and the events that need to be recorded. Audit-log coverage and access tests must be confirmed for the delivered version.

Encryption and configuration

HTTPS protects web transport when the certificate and configuration are valid. It is not the same as encryption of stored data. Password-containing configuration must be kept separate from public files; storage and integration options are checked before launch.

Backup and recovery

Backup frequency, retention period, storage location, restore tests and recovery objectives are defined explicitly. We do not promise a recovery time or availability without an agreement.

Personal data and retention

We define data categories, purposes, people with access, retention periods and deletion or export procedures. The parties’ roles and obligations must be documented before using real personal data.

Integrations and IT review

Any API or integration requires defined authentication, permissions, data validation and error handling. We can review your company’s security questionnaire and the evidence needed for acceptance.

Contact

For questions about security or data: contact@qapp.ro. Do not send passwords or sensitive data through the public form.