MaestroQA, Inc. | Trust Center
MaestroQA Trust Center
MaestroQA is committed to the security of our customers and their data. Here is how we protect information and comply with industry standards and regulations.
See Resources

Compliance

SOC 2 Type 2

Service Organization Controls (SOC 2) (Type II) - Security, Confidentiality and Privacy

ISO 27001

ISO/IEC 27001 information security, cybersecurity and privacy protection

PCI

PCI DSS 4.0 Level 1 Service Provider AOC

HIPAA

Type 1 Attestation (AT-C 105, AT-C 205 and AT- C 315) HIPAA / HITECH

GDPR

Protect the personal data and privacy of EU and UK citizens for transactions that occur within EU member states and UK

CCPA

California Consumer Privacy Act, is legislation designed to improve the data privacy of California residents

ISO 42001

We are proud to share that our team is fully aligned with the requirements of ISO/IEC 42001 for AI management systems, demonstrating our commitment to trustworthy, and secure AI practices. Using the audit monitoring tool SecureFrame, we have verified 100% compliance with ISO 42001 standards, ensuring that all processes and controls are in place. While the external certification audit is expected soon, this milestone underscores our dedication to maintaining the highest standards in AI governance, with the official certification to follow soon.

AWS Qualified Software / Partner

AWS Foundational Technical Review (FTR) Validation making us an officially certified AWS Partner. This validates MaestroQA's alignment with AWS’s highest standards of security, reliability, and operational excellence.

MaestroQA Overview and Security

MaestroQA

MaestroQA is a Quality Management, Coaching, and Analytics Solution that helps assess areas of improvement within the customer experience to drive customer loyalty and satisfaction. We help organizations achieve this through workflow automations, human-driven assessments, and in-depth reporting. MaestroQA was founded in November 2013 with the objective of helping companies improve the quality of their customer experiences. MaestroQA allows companies to monitor, quantify, and improve their support by providing a platform for review and collaboration on customer conversations. The organization is based in New York City and serves customers around the world with their cloud based solution. MaestroQA services many industries and organizations around the world, varying from small and medium businesses to Fortune 500 enterprises.

MaestroQA is also the recommended Quality Assurance partner for Zendesk and Salesforce. MaestroQA has officially received AWS Foundational Technical Review (FTR) Validation making us an officially certified AWS Partner. This validates our alignment with AWS’s highest standards of security, reliability, and operational excellence.

Security

MaestroQA is committed to the security of our customers and their data. As a cloud-based company entrusted with some of our customers’ most valuable data, we are focused on keeping you and your data safe. MaestroQA undergoes periodic penetration testing and vulnerability assessments, is designed to be GDPR-compliant, and encrypts data at rest and in-transit.‍ Our customers entrust sensitive data to our care. Keeping customer data safe is our priority.

Secure and Reliable Infrastructure

MaestroQA uses Amazon Web Services (AWS) for secure and resilient hosting of staging and production environments. MaestroQA leverages multiple availability zones to redundantly store customer data. AWS data centers are monitored by 24×7 security, biometric scanning, video surveillance and are continuously certified across a variety of global security and compliance frameworks.

Customer Data

Data used - Employee performance data entered into the system through use of our product. Our product pulls ticket data as defined by the credentials provided to MaestroQA during initial configuration/setup with customers. MaestroQA also provides an option to limit/tag certain fields within the ticket and block the data for the marked fields to be pulled.

All data is encrypted at rest, in transit, and during backup. Access to data is limited to authorized personnel. Data retention in configurable, and data deletion process is in place.

Bug Bounty

We partner with HackerOne to run a private bug bounty program to help surface and resolve security vulnerabilities before they can be exploited.

AWS-Validated Solution for Your Business

Our product has been validated by AWS through the Foundational Technical Review (FTR), demonstrating adherence to the highest standards of security, reliability, and operational excellence.

What this means for our customers:

  • Trust: AWS Qualified Software and Partner Badges ensure credibility.
  • Reliability: Built on AWS best practices for seamless performance.
  • AWS Ecosystem Alignment: Listed on AWS Partner Discovery Portal and Solutions Finder.

    • Privacy Documents

    Acceptable Use Policy Link to MaestroQA Acceptable Use Policy.
    Cookie Policy [Please refer to the Resources section]
    Security Contact - [email protected]
    MaestroQA Privacy Policy

    Monitoring

    Continuously monitored by Secureframe

    Resources

    SOC 2 Type 2 Report

    Security, Confidentiality and Privacy Criteria; Period - January 1, 2023 - September 30, 2023

    ISO27001 Certificate

    Current Certificate valid until: January 6, 2028

    PCI DSS 4.0 AOC

    Level 1 Service Provider

    HIPAA report

    Information Security Policy

    Penetration Test Report

    Data Flow & Network Diagram

    MaestroQA Cookie Policy

    Subprocessors

    Amazon Web Services

    Data Hosting - Available options - US and EU

    MongoDB

    Data Processing

    Coralogix

    Monitoring operations of MaestroQA Services

    Fullstory

    Product analytics and debugging - no end user data shared

    FAQs

    MaestroQA currently integrates with Okta, One Login, Jump Cloud, Duo, ADFS, Azure SAML, and Google SAML for JIT user provisioning, SCIM, and SSO. We also support integration with other SSO solutions so long as they support creation of custom applications. If you have questions on if your solution is supported, please reach out to your MaestroQA account representative. Refer to our help article at - https://help.maestroqa.com/en/articles/6715940-saml-sso-single-sign-on-integration-details
    With MaestroQA, admins can provide limited-access permissions to certain accounts. Below are the roles that are available in Maestro: Admin Limited Admin Grader Manager Agent (Limited to Professional and higher packages) Limited Agent (limited to Professional and higher packages) Read more about user roles and permissions - https://help.maestroqa.com/en/articles/4742446-understanding-role-permissions

    Monitoring

    Change Management

    Software Change Testing
    Software changes are tested prior to being deployed into production.
    Secure Development Policy
    A Secure Development Policy defines the requirements for secure software and system development and maintenance.
    Configuration and Asset Management Policy
    A Configuration and Asset Management Policy governs configurations for new sensitive systems
    Approval for System Changes
    System changes are approved by at least 1 independent person prior to deployment into production.
    Segregation of Environments
    Development, staging, and production environments are segregated.
    Change Management Policy
    A Change Management Policy governs the documenting, tracking, testing, and approving of system, network, security, and infrastructure changes.
    Production Data Use is Restricted
    Production data is not used in the development and testing environments, unless required for debugging customer issues.

    Organizational Management

    Personnel Acknowledge Security Policies
    Internal personnel review and accept applicable information security policies at least annually.
    Background Checks
    Background checks or their equivalent are performed before or promptly after a new hires start date, as permitted by local laws.
    Performance Reviews
    Internal personnel are evaluated via a formal performance review at least annually
    Information Security Program Review
    Management is responsible for the design, implementation, and management of the organization’s security policies and procedures. The policies and procedures are reviewed by management at least annually.
    Organizational Chart
    Management maintains a formal organizational chart to clearly identify positions of authority and the lines of communication, and publishes the organizational chart to internal personnel.

    Confidentiality

    Data Retention and Disposal Policy
    A Data Retention and Disposal Policy specifies how customer data is to be retained and disposed of based on compliance requirements and contractual obligations.
    Data Classification Policy
    A Data Classification Policy details the security and handling protocols for sensitive data.

    Incident Response

    Lessons Learned
    After any identified security incident has been resolved, management provides a "Lessons Learned" document to the team in order to continually improve security and operations.
    Incident Response Plan
    An Incident Response Plan outlines the process of identifying, prioritizing, communicating, assigning and tracking confirmed incidents through to resolution.
    Tracking a Security Incident
    Identified incidents are documented, tracked, and analyzed according to the Incident Response Plan.

    Risk Assessment

    Vendor Due Diligence Review
    Vendor SOC 2 reports (or equivalent) are collected and reviewed on at least an annual basis.
    Risk Assessment and Treatment Policy
    A Risk Assessment and Treatment Policy governs the process for conducting risk assessments to account for threats, vulnerabilities, likelihood, and impact with respect to assets, team members, customers, vendors, suppliers, and partners. Risk tolerance and strategies are also defined in the policy.
    Risk Register
    A risk register is maintained, which records the risk mitigation strategies for identified risks, and the development or modification of controls consistent with the risk mitigation strategy.
    Vendor Risk Assessment
    New vendors are assessed in accordance with the Vendor Risk Management Policy prior to engaging with the vendor. Reassessment occurs at least annually.
    Risk Assessment
    Formal risk assessments are performed, which includes the identification of relevant internal and external threats related to security, availability, confidentiality, and fraud, and an analysis of risks associated with those threats.
    Vendor Risk Management Policy
    A Vendor Risk Management Policy defines a framework for the onboarding and management of the vendor relationship lifecycle.

    Network Security

    Automated Alerting for Security Events
    Alerting software is used to notify impacted teams of potential security events.

    Access Security

    Unique Access IDs
    Personnel are assigned unique IDs to access sensitive systems, networks, and information
    Access to Product is Restricted
    Non-console access to production infrastructure is restricted to users with a unique SSH key or access key

    Communications

    Privacy Policy
    A Privacy Policy to both external users and internal personnel. This policy details the company's privacy commitments.
    Confidential Reporting Channel
    A confidential reporting channel is made available to internal personnel and external parties to report security and other identified concerns.
    Description of Services
    Descriptions of the company's services and systems are available to both internal personnel and external users.
    Terms of Service
    Terms of Service or the equivalent are published or shared to external users.