Technical and Organisational Measures

This document describes the technical and organisational measures Qlix applies to protect personal data, as required by Articles 28(3)(c) and 32 of the UK GDPR. It is provided to schools, tutors and their data protection officers, and forms part of our Data Processing Agreement as Schedule 2.

Every statement in this document must be true on the day it is published. Where a measure is planned rather than in place, it is marked as such. We would rather understate our position than describe controls we have not built.

Qlix Limited · Version 1.0 · 23 July 2026

Qlix Limited is incorporated in Hong Kong SAR. This is the place of incorporation only: no personnel are located there and no access to customer data takes place from Hong Kong SAR.

Qlix personnel are located in the United Kingdom and Thailand. Remote access from Thailand is treated as a restricted transfer and is governed by a UK International Data Transfer Agreement supported by a documented Transfer Risk Assessment.

• Role-based access control on a least-privilege basis
• Multi-factor authentication required for all administrative and production access
• Named-individual accounts; no shared credentials for production systems
• Access reviewed at least annually and revoked within 24 hours of role change or departure
• Separate credential sets for production and non-production environments
• Production access logged, with logs retained for 90 days

• TLS 1.2 or above enforced for all data in transit
• AES-256 encryption at rest for databases, object storage and backups
• Encryption keys managed through AWS Key Management Service

Qlix holds teaching content and student records in structurally separate stores, and only one is shareable:

There is no configuration in which a student record, submission, mark or teacher note can be attached to a shared or published item. A persistent visual warning is displayed whenever content is shared outside the school or made public.

• Student names and direct identifiers are replaced with pseudonymous tokens before any content is transmitted for AI inference
• The token mapping is held separately within UK infrastructure and is never transmitted
• No analytics, advertising or behavioural tracking technologies operate on QlixGo, the student-facing surface

• Input validation and parameterised database queries
• Session management with configurable timeout
• Passwords stored using a modern adaptive hashing algorithm
• Passkey authentication supported
• Rate limiting on authentication endpoints
• Cross-site request forgery protection on state-changing operations

• Segregated production environment; production data is never used in development or testing
• Managed firewall and security group configuration on a default-deny basis
• Automated dependency and container vulnerability scanning
• Security patches applied within 14 days for high and critical severity findings
• Change management process for production deployments

• Automated daily backups, retained 30 days
• Backups held separately from primary infrastructure, within the United Kingdom
• Documented restore procedure, tested quarterly
• Recovery time objective: 1 hour
• Recovery point objective: 24 hours

• Written confidentiality obligations for all personnel and contractors, surviving termination of engagement
• Data protection training for all personnel with access to customer data, at least annually
• Documented incident response procedure with defined escalation and notification steps
• Personal data breaches notified to the controller within 24 hours of Qlix becoming aware
• Named data protection contact maintained for each customer

• Written data protection terms in place with every sub-processor
• Sub-processor register maintained and published on our trust and security page
• 30 days' written notice before any sub-processor is added or replaced
• Right for the customer to object on reasonable data protection grounds

• Self-service export and deletion available in-product at any time
• Requests received directly from data subjects are forwarded to the controller within 3 working days and are not answered substantively by Qlix
• On termination: export available for 30 days; live data deleted within 30 days; backup copies deleted within 90 days
• Written confirmation of deletion provided on request

• Inference performed in the United Kingdom (Amazon Bedrock, London)
• Content pseudonymised before transmission
• Customer data is never used to train, fine-tune or evaluate any AI model. This is a contractual commitment that survives termination, and our AI sub-processor is contractually prohibited from doing the same
• AI context is controllable by the customer at organisation and individual user level
• All AI output is presented as a draft for review by a member of teaching staff; no significant decisions are made solely by automated means

We are a small team. We would rather state plainly what we do not hold than imply certifications we have not earned. If your procurement process requires ISO 27001 or SOC 2, please tell us early so neither of us wastes time.

Report suspected vulnerabilities to security@qlixapp.com. We acknowledge within two working days and will keep you informed while we investigate. We will not pursue researchers who report in good faith, give us reasonable opportunity to remediate before public disclosure, and do not access or modify data belonging to others.

Qlix Limited · Company number 74458271 · Rooms 1703-1704, 17/F Tung Chiu Commercial Centre, 193 Lockhart Road, Wan Chai, Hong Kong SAR