Security Overview

- As a hosted solution, we regularly improve our system and update security patches. Non-critical system updates will be installed at predetermined times, while critical application updates are performed ad hoc using rolling deployment to maximize system performance and minimize disruption. All updates and patches will be evaluated in a virtual production environment before implementing.
‍
- All PhysioQ users are informed of new PhysioQ version rollouts, with information on changes and potential feature updates.

- PhysioQ performs regular Vulnerability Assessments once a month. Additional internal security testing is performed on the testing environment before the code is merged into a master repository.

- Two-step verification provides an extra layer of security designed to ensure that user accounts can only be accessed by those given explicit access.

- With our trusted device management, accounts are protected with extra steps when being accessed by a new device.

- PhysioQ requires user passwords to conform with high-level password security to limit the possibility of brute-force attacks. Passwords cannot be recovered, as PhysioQ doesn’t store the original password (only an undecryptable version), thus, users are required to create new passwords in case of a lost password.

- PhysioQ’s password policy requires each user to create a password that must consist of at least 8 characters with at least one number, one capital letter, and one lower case letter.

- PhysioQ utilizes various account permission settings to allow secure collaboration with other PhysioQ users on a project. Administrators can customize user rights and responsibilities, from principal investigators to research assistants, ensuring projects and data can only be accessed by those given explicit access.

- All data sent between PhysioQ users and the system is encrypted with use of the Secure Socket Layer (SSL) and Transport Layer Security (TLS) technologies. This keeps data secure while in transit and ensures it can only be interpreted by the intended parties.

- Research participants have entrusted researchers with their data, and we believe in upholding that trust. We actively help researchers protect the confidentiality of participants, ensuring that all their data is anonymized before entering our system. Furthermore, no participant data is allowed to be collected without first having the researchers’ and participants’ consent.
‍
- PhysioQ does not save the participants’ personal details. Instead, we create identification codes for your participants, which can be defined by the researcher. These IDs are anonymous and unalterable. They can also be automatically generated when a new participant is included. It is the researcher’s responsibility to keep a record of the participant IDs linked to personal data.  

- We advise all researchers not to store participant-identifiable information within PhysioQ, such as surnames, Social Security numbers, DOBs, and so on. The safest solution is to use the PhysioQ participant ID and to connect their computer to the participant data within their own network. This will ensure that participant information can never be traced back to a participant.

- Physical access is controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means.

- No third party has access to any data on AWS hosting services.
‍
- Amazon does not access any of the data collected and stored on PhysioQ servers. As stated directly by AWS “As a customer, you maintain ownership of your content, and you select which AWS services can process, store, and host your content. We do not access or use your content for any purpose without your consent. We never use customer content or derive information from it for marketing or advertising.- PhysioQ ensures strong encryption for your data while in transit and at rest.

‍
- Only select PhysioQ employees are able to access the server network.

- All AWS data centers are equipped with components like back-up power equipment, HVAC systems, and fire suppression equipment. They are built to mitigate environmental risks, such as flooding, extreme weather, and seismic activity.

- PhysioQ maintains real-time data stores mirrored across multiple geographic availability zones in AWS within the United States. In a disaster situation, the full PhysioQ platform will be recreated and available in a different availability zone within a day of the disaster declaration.

- PhysioQ incorporates the newest technologies for secure computing and data storage. However, data transmission over the internet and data storage can never be guaranteed 100% secure. As such, if a security breach should occur, we will do everything to inform you as soon as possible and minimize damage. A formal notice will contain the type of security breach the system was subject to and what measures have been taken to ensure minimal data breach. In addition, PhysioQ will inform all users of which actions to take to minimize any risk of inconvenience.