Designed to protect your data with clear controls, strong encryption, and secure defaults.
About DoesQA
DoesQA is a UK company. All product infrastructure runs on AWS in London (eu-west-2). We are fully cloud-based: there is no on-premises customer data centre in scope.
Samuel Smith is the responsible person for IT systems. High-risk or critical security updates are applied within 14 days.
Certification and assurance
Topic | Where we are |
|---|---|
Cyber Essentials | Cyber Essentials certified |
Leadership review | Controls and documentation approved annually |
Cyber Essentials Plus / SOC 2 / ISO 27001 | In progress, target horizon 2027 |
Ask sales for the latest status if your procurement pack needs a formal letter.
Devices and software
We use Windows, macOS, iOS, and Android. All devices are vendor-supported, patched promptly, and protected by firewalls and malware protection. Unsupported operating systems and beta software are out of scope.
Unnecessary software is removed or disabled. Cloud tools stay current through the vendor. Windows and macOS endpoints use Malwarebytes Endpoint Protection. Mobile installs come from official app stores only.
Networks and cloud
Customer workloads and DoesQA product services run in AWS eu-west-2. Contractor home networks use WPA2/3, strong unique passwords, and software firewalls. AWS networks use strict access rules.
Business SaaS includes Google Workspace, Slack, GitHub/GitLab, Trello, HubSpot, Xero, and similar tools, each behind authenticated access.
Access, passwords, and firewalls
Control | Practice |
|---|---|
Least privilege | Standard access by default; admin rights only when approved |
Admin accounts | Separate named accounts with MFA for privileged work |
Passwords | At least 12 characters, or 8 with MFA; guessable passwords blocked |
Firewalls | Device firewalls on; AWS security groups deny inbound by default |
Inbound rules | Only essential HTTPS/TLS; board-approved business cases |
Account Owners can restrict DoesQA sign-in to approved IPs and CIDR ranges |
Accounts are disabled promptly when people leave. Login attempts are throttled or locked after repeated failures. Firewall posture is reviewed at least annually or when infrastructure changes.
Data and services
External services that hold or process business data require authentication, with MFA where the vendor supports it. Customer-facing DoesQA services use secure defaults and encryption in transit.
Need a deeper questionnaire? Start here, then reach out via Contact or your DoesQA contact. For product capability, see Platform.
