Security and compliance

Security standards
Aligned with best practice

NIS2
Compliance in progress

GDPR
EU data protection

Product Security

Qlara applies security-by-design principles across its application and infrastructure. Security requirements are considered during product design, development, testing and release, with attention to secure coding, environment segregation, vulnerability management and controlled changes. The product is subject to a governance model that includes risk assessment, internal audit activities, policy review and continuous improvement.

Secure Data Handling

Qlara validates and controls data received by both frontend and backend components. Input and output data are managed to reduce the risk of code injection, manipulation or unauthorized processing. Where invalid input is detected, the application handles the event without exposing technical details that could reveal internal logic or information useful to a potential attacker.

Communication Security

Qlara protects communications between client and server through HTTPS and secure TLS protocols. TLS 1.2 or higher is used to protect data in transit, while weak or deprecated configurations are avoided to reduce the risk of interception or downgrade attacks. Communications involving infrastructure, databases and internal services are protected through encrypted channels and controlled access paths.

Authentication & Access Control

Access to Qlara and related systems is governed by formal access control principles, including least privilege, need-to-know and segregation of duties. User permissions are assigned according to role, responsibility and operational need, and are subject to review, update and revocation when roles change. Privileged access is limited to authorized personnel and subject to logging, monitoring and periodic review.

Password & Secret Protection

Qlara does not store passwords in clear text. Passwords and secrets are protected using secure hashing and credential management practices. Password recovery and change processes rely on verified communication channels, and sensitive credentials are not exposed through URLs. Technical credentials and access keys are managed with traceability and rotation practices where applicable.

Session Security

Qlara implements secure session management practices. Sessions are protected through secure tokens and cookies configured to reduce unauthorized access or reuse. Logout processes invalidate session information, and inactive sessions are managed to limit exposure from unattended or abandoned sessions.

Database Security

Qlara’s database layer is protected through restrictive exposure rules. Databases are not publicly reachable and accept connections only from authorized hosts and services. Database users are separated by service where applicable, and privileges are assigned according to least privilege and need-to-know principles. Secure query practices reduce the risk of injection and preserve data integrity.

Logging & Monitoring

Qlara generates logs for access events, relevant user actions and security-significant activities. Logs are centralized and protected against unauthorized access or alteration. Monitoring supports anomaly detection, incident analysis, audit activities and forensic reconstruction where needed. Security events may be escalated to the relevant cybersecurity functions and SOC according to internal procedures.

Threat Detection & Malware Protection

Qlara benefits from Agile Telecom and Growens security controls designed to reduce exposure to malware, intrusion attempts and misconfiguration. Assets are protected through centralized security tools, endpoint protection, antimalware controls, patching, firewall protections, network segregation and monitoring. Suspicious activity is reported and managed through defined escalation channels.

Vulnerability Management

Qlara is included in a vulnerability management approach based on identification, analysis, prioritization and remediation of weaknesses. Vulnerability assessment and penetration testing activities are planned according to risk, with reports used to identify corrective actions. Before production release, systems and services are assessed to avoid deploying components with unacceptable risk levels.

Secure Development Practices

Qlara follows secure software development practices aligned with Group guidelines. Development, test and production environments are kept separate, and releases are managed through controlled processes. Code changes, testing and deployment activities are subject to review and traceability, with security requirements considered during design and implementation in line with cybersecurity-by-design principles.

Backup & Recovery

Qlara is supported by backup and recovery practices designed to preserve data availability and support service recovery in case of deletion, corruption, loss or disruption. Backup processes are performed regularly, protected through appropriate security measures and periodically tested to verify recoverability. Recovery activities are monitored and subject to corrective actions where issues are identified.

Business Continuity & Resilience

Qlara is operated within a broader resilience framework covering business continuity, disaster recovery, incident response and crisis management. The organization identifies critical processes, dependencies, suppliers and recovery objectives in order to maintain service continuity and support restoration in case of disruption.

Incident Response

Qlara is covered by a formal incident handling process. Security events and suspected incidents are reported through defined channels and managed through triage, analysis, containment, eradication, recovery and post-incident review. Incident management involves the relevant cybersecurity, IT, legal, privacy and business functions, with escalation to authorities where required by applicable law, including NIS2 and GDPR.

AI Security

Where Qlara uses AI capabilities, the related models and processing are managed within Agile Telecom’s technology environment and subject to the same security controls applied to the broader product and infrastructure perimeter: access control, monitoring, encrypted communications, asset protection and governance over the data processed by AI-enabled components.