We score your conversations. We protect them too.

An independent auditor is examining the design of our security controls against the AICPA Trust Services Criteria. The engagement is in progress; we will publish the completion here and share the report with customers and prospects under NDA once issued.

Planned. The Type II audit tests that the same controls operate effectively over a monitoring period, and we intend to begin that engagement once Type I is complete.

Our hosting provider's data centres are independently certified to ISO/IEC 27001. Our own information security management system follows ISO 27001 practices; certification for MartialQA itself is planned. Certificate details on request.

An independent security firm has penetration tested the platform. Findings were remediated and a summary letter is available under NDA.

Cloud hosting and data regions

MartialQA's application, database and primary customer storage run on Hetzner cloud infrastructure in the European Union, in ISO 27001 certified data centres. Certain subprocessors, including our AI providers, may process customer content in other regions, as disclosed openly on our Subprocessors page.

Encryption in transit and at rest

All traffic between your browser, our services and our providers is encrypted with TLS 1.2 or higher. Data at rest, including databases, file storage and backups, is encrypted with AES-256. Passwords are stored with salted one-way hashing and are never logged.

Tenant separation

Every customer's data is scoped to their own workspace. Authorisation is enforced on every request at the application layer, and our controls are designed so that one tenant's conversations, scorecards and reports are never visible to another. We intend to bring this separation into scope for a future penetration test.

Backups and disaster recovery

Critical data is backed up on an automated schedule to a separate location within the EU, encrypted at rest. We test restores as part of our recovery procedures, and a documented disaster recovery plan covers loss of a data centre.

Role-based access controls

Access inside MartialQA follows least privilege. Administrators, managers, reviewers and agents each see only what their role requires: agents see their own scores and coaching, managers see their teams, and workspace admins control who holds which role.

Authentication and MFA

Multi-factor authentication is available on every account, and we recommend enforcing it for all users. Sessions expire automatically, and repeated failed logins are throttled to resist credential stuffing.

Employee access and security training

Our team's access to production systems is limited to the few people who operate them, granted on least privilege, reviewed regularly and revoked promptly on role change or departure. Everyone signs confidentiality undertakings and completes security training at onboarding and annually.

Logging and monitoring

Application and infrastructure events are logged centrally, with alerting on suspicious activity such as unusual access patterns or failed login bursts. Access to logs is itself restricted and logged.

Secure software development

Changes go through code review before deployment, development and production environments are separated, secrets are managed outside the codebase, and we build against OWASP guidance for common attack classes such as injection and cross-site scripting.

Vulnerability scanning

Automated scanning runs across our dependencies and infrastructure, and findings are triaged and patched on a severity-based schedule, with critical issues prioritised immediately.

Penetration testing

Beyond automated scanning, an independent security firm penetration tests the platform, including authentication. Findings are remediated and verified, and a summary is available to customers under NDA. We intend to bring tenant separation into scope for a future test.

Incident response

We maintain incident response procedures covering triage, containment, recovery and post-incident review. If an incident affects your data, we notify you without undue delay, with what we know, what we are doing, and what it means for you. Breach notification commitments are set out in our Data Processing Addendum.

Data protection and privacy

MartialQA is POPIA compliant and applies GDPR-aligned data protection practices. Our Privacy Policy covers what we collect and why, our DPA covers processing on your behalf, and our Responsible AI page covers how AI is used.