Security is the first design parameter that VIQ Solutions considers when products and features are developed. VIQ’s security policies and principles are incorporated at the forefront of product development initiatives and extended throughout the software development lifecycle. Security is never finished: VIQ takes a risk-based approach and improves as technology and practice change.
ISO/IEC 27001
SOC 2 Type I & II
CJIS ACE
Winning the prestigious "Fortress Cybersecurity Award" from Business Intelligence Group signifies exceptional achievement in safeguarding digital infrastructure. This recognition validates an organization's dedication to strong cybersecurity practices, ensuring protection against evolving threats and inspiring confidence in stakeholders and clients alike.
VIQ's platforms run on industry-standard public cloud environments. That approach lets the platforms scale quickly, and it brings security benefits: continuous monitoring, and fast feedback on emerging threats.
VIQ products are designed with the user interface securely accessible via a web browser. Our modern web applications are designed to provide the highest level of security while delivering ease of access and usability.
VIQ's platforms are designed to ensure that confidential audio/video recordings and transcription files are never stored locally. Files are encrypted at all stages of storage and transmission to ensure that they remain confidential throughout the lifecycle of the transcription process.
VIQ's speech-to-text processing runs inside VIQ's own cloud. Recordings are not sent to third-party services for processing. Where a customer asks for transcription tuned to its own vocabulary and formatting, that tuning is built from that customer's data alone, is available only to that customer, and is never applied to another customer's work. Data is stored in VIQ's cloud within the customer's country, encrypted at rest and in transit, and handled in accordance with GDPR.
Data produced and hosted on VIQ's NetScribe® platform is stored on the AWS and Azure clouds. VIQ runs a separate instance of NetScribe in the UK, so UK data stays in AWS and Azure UK regions. Where a customer requires its own isolated environment, VIQ provisions a separate tenancy on the platform, with access governed by an administrator inside the customer's own organization.
VIQ follows best practice for source code control and stores all code within an industry-standard secure repository. All access to the source code is monitored and tracked.
VIQ operates dedicated environments for the development and testing of our products and services to ensure production data is not exposed in non-production environments.
VIQ assets are configured in accordance with best practices for security and hardening. Changes to VIQ systems and products are subject to formal review, approval and testing.
VIQ is a global company that draws on talent from multiple countries to execute high quality, cost-effective services for our customers. As a result, VIQ services are hosted in dedicated geographic regions and cloud environments with controls to meet customer security and compliance requirements regarding privacy and data sovereignty.
VIQ maintains an ISO/IEC 27001 certification which covers VIQ’s global operations. All security controls are aligned with industry-standard frameworks including the NIST Cybersecurity Framework.
VIQ Solutions is a member of the CyberGRX Exchange, a platform that enables organizations to manage and monitor third-party cyber risk. As a member, VIQ Solutions has undergone a comprehensive cyber risk assessment and has been certified as a trustworthy and secure vendor. VIQ's customers subscribed to CyberGRX can request access to our assessment, which provides insights into our security posture and helps customers make informed decisions about working with us.
This rigorous audit and attestation, conducted by an independent Australian certification body, AssuranceLab, validates VIQ as a trusted and secure platform partner, especially crucial for highly regulated industries.
The SOC 2 framework, developed by the American Institute of Certified Public Accountants (AICPA), examines an organization's controls for protecting and securing its systems and services. VIQ's successful certification demonstrates its compliance with stringent standards for security, availability, processing integrity and confidentiality, as defined by the framework's Trust Services Criteria (TSC).
Covers VIQ’s global operations.
Audit and attestation conducted by AssuranceLab.
Exchange member.
DoD IL5 Provisional Authorization
General Data Protection Regulation
Requirements for IT infrastructure
Quality Management Systems
Disk encryption and encrypted data stores for cloud-based resources
Dedicated encryption keys for customers within VIQ databases
256-bit SSL certificate and asymmetric 2,048-bit RSA key encrypted channel of transmission for files
Encryption in-transit (SSL/TLS 1.2) for web-based apps
Endpoint Security
Attack Surface Reduction (Ports, IPs, APIs)
Protections Against Phishing: Sandbox execution, URL re-writing, Automated phish reporting
Vulnerability Scanning: Evaluation of exposure to OWASP Top 10 web application security risks
Penetration Testing: Periodic testing via independent 3rd parties to complement the ongoing scanning and assessment activities performed by the security team
Centralized Security Information and Event Monitoring (SIEM): Evaluates events related to user access, software execution, high-risk network traffic, known threat actors, etc.
Completed transcripts can be securely retrieved from Transcript Management Center for up to 90 days, or archived for up to three years
Cloud environments: VIQ servers are configured for automated backups, redundancy and failsafe deployment
On-premise deployment: Custom designed to meet customer needs for redundancy and high availability as needed
E-verification and background check for all employees and contractors
Rigorous assessment process, routine performance reviews and work quality audits
Multi-Factor Authentication
Dedicated Accounts and Authentication Channels for Administrative Access
Role-Based Access Controls
Recurring Access Reviews
All workstations individually password-protected, programmed to log off after 10 minutes of inactivity, and running current versions of anti-virus, anti-spyware and anti-malware software
Our team can walk your reviewers through how VIQ protects recordings and transcripts, from hosting to access controls.
