1. Security approach
HQL applies reasonable administrative, technical and organizational safeguards appropriate to a hosted business application that may process confidential immigration and professional information. Security controls are reviewed and may evolve as the platform, threat environment and legal requirements change.
2. Access control
- Access is restricted to authenticated users and role-based permissions configured for the relevant organization.
- Users should receive only the level of access required for their role and work.
- Subscribing organizations are responsible for promptly disabling users who leave, change roles or no longer require access.
- Administrative access should be limited to authorized personnel with a legitimate operational need.
3. Auditability and accountability
The platform may maintain audit, access, workflow and security records to support accountability, troubleshooting, incident investigation and compliance. Audit information should not be altered or disabled except through authorized administrative or maintenance processes.
4. Sensitive data handling
Immigration files can contain passports, civil-status records, financial information, health-related information, criminal-history material and information about family members. Users must upload only information necessary for a lawful case purpose and should avoid duplicating sensitive material unnecessarily.
Access to sensitive information should follow a need-to-know principle and the customer’s professional, legal and regulatory obligations.
5. Infrastructure and service providers
HQL may use reputable third-party cloud, database, hosting, authentication, communications, monitoring and related infrastructure providers. HQL evaluates service providers according to the nature of the service and uses contractual or technical controls appropriate to the risk.
Because service infrastructure may span jurisdictions, customers should review the Privacy Notice and any applicable data-processing agreement for cross-border processing responsibilities.
6. Secure development and change management
HQL aims to apply secure-development practices appropriate to the platform, including controlled source-code changes, review of material changes, environment separation where appropriate, dependency maintenance and remediation of identified vulnerabilities according to risk.
7. Backups and continuity
Reasonable backup and recovery measures may be used to support service continuity. Backup availability, retention periods and recovery objectives may depend on the subscribed service and underlying infrastructure. Customers should not treat the CRM as a substitute for any legally required independent archival process unless a signed agreement expressly provides that service.
8. Incident response
HQL will investigate suspected security incidents affecting the platform and take reasonable containment and remediation steps. Where a confirmed incident affects Customer Data, HQL will communicate with the affected subscribing organization as required by applicable law and contractual commitments.
The subscribing organization is responsible for regulator, client or data-subject notifications where it is legally the responsible controller/data fiduciary, unless a written agreement assigns a different responsibility.
9. Customer security responsibilities
- protect passwords and authentication methods;
- use secure and supported devices, browsers and networks;
- avoid credential sharing and unauthorized exports;
- review role permissions and user access regularly;
- train staff on confidentiality, phishing and appropriate handling of immigration files;
- promptly report suspicious access, lost devices, accidental disclosure or suspected compromise;
- maintain any additional controls required by professional rules, privacy laws or customer contracts.
10. Responsible reporting
Customers and authorized users who identify a suspected vulnerability or security weakness should report it privately through their authorized HQL Solutions contact and should not exploit the issue, access data beyond what is necessary to demonstrate the issue, or publicly disclose confidential security details before HQL has had a reasonable opportunity to investigate and remediate.
11. No absolute security guarantee
No internet-connected service can guarantee absolute security or uninterrupted availability. This statement describes security principles and responsibilities; it is not a warranty that every threat, outage or unauthorized act can be prevented.