SECURITY AND DATA
CORE CONTROLS
Organisation roles, controlled invitations, password safeguards, session revocation and multi-factor authentication reduce the risk of unauthorised access. Sensitive changes create traceable account activity.
Transport security protects data in transit, while credentials and certificate material are encrypted at application level before storage. Applicant payloads are excluded from routine logs and operational notifications.
Uploads and returned data are permanently deleted seven days after payment, or 30 days after processing if unpaid. Deletion evidence, invoices and privacy-safe audit records can remain without retaining the applicant payload.
DEFINED DATA LIFECYCLE
Applicant data is retained for a limited purpose — then removed.
Uploads and returned qualification data are scheduled for permanent deletion seven days after payment, or 30 days after processing if unpaid. The deletion process removes the sensitive batch payload while retaining only the non-sensitive invoice, audit and deletion evidence needed to show what happened.
after payment
after processing when unpaid
SECURITY BY DESIGN
How the safeguards work together.
Identity and access
Controlled invitations, organisation roles, password safeguards, session revocation and multi-factor authentication limit who can reach sensitive workflows.
Boundaries and encryption
Organisation-level data boundaries keep customer records separated. Credentials and certificate material are encrypted before storage, and sensitive payloads are excluded from routine logs.
Payment and downloads
Signed, idempotent payment webhooks unlock results. Downloads require an authenticated, short-lived link, so a copied redirect or stale browser page cannot release the dataset.
Audit and deletion
Important actions remain reviewable without repeating applicant payloads. Paid batch data is deleted after seven days; unpaid batch data is deleted 30 days after processing.
ACCOUNTABILITY
Administrators can search significant account and processing events by text or date, while the audit trail avoids storing applicant payloads or repeating corrected demographic values.
Pre-payment previews mask identifiers, omit submitted demographics and are not cached. Complete outputs remain unavailable until payment has been independently confirmed.
Card and Pay by Bank journeys are handled through Stripe Checkout. Signed, idempotent webhooks confirm payment before Qualifia releases result downloads, reducing reliance on a browser redirect or client-side status.