Client Services data is hosted on Microsoft Azure data centers in Singapore and the Netherlands with reliable power sources, backup systems and redundancy. Service availability commitments are governed by the applicable SLA.

Azure’s infrastructure is certified for many standards including SOC 2, PCI DSS Level 1, Fedramp. Each client has a dedicated database with no mixing or blending of Services data with that of other customers.

Quantium automatically creates a backup of the database on a daily basis for the past ninety (90) days. For data older than (90) days, backup is done on a weekly basis throughout service period.

Azure App Service provides load balancing capabilities to distribute traffic across multiple instances of an application. This enables traffic to be automatically distributed across these instances and ensures that application traffic is handled seamlessly.

Yes, Quantium allows for flexible scope / visibility settings whereby the system administrator from client side can customize the access rights of each user to particular sets of entity (e.g. asset, funds) depending on each client’s requirements.

The client administrator can also configure each user’s access to different menus (e.g. fund summary, portfolio analytics) to be full access, read-only or no access.

Quantium currently offers two types of sign–in methods:

1. Quantium ID credentials: Accessed using a username and password which are managed by Quantium authentication services and implemented through IdentityServer4. This authentication method is fully compliant with oAuth2.0 standards.
2. Microsoft SSO: Seamless integration available for organizations using Microsoft Azure Active directory. This method can be enabled by the client’s administrator.

Data export, retention and deletion following termination are governed by the applicable service agreement and data retention policies. Quantium makes Service Data available for export or download at the client’s request, as set out in that agreement.

• Access Control and Privilege Management: We restrict administrative access to production systems to only Approved Personnel.
• Approved Personnel for System Implementation: During system implementation and data migration process, specific project members from Quantium Client Solutions Team shall have access to data provided by customers for data migration and reconciliation purpose and constitute as Approved Personnel. Upon client confirmation of data migration process completion, client raw data shall be deleted within thirty (30) days after system Go-Live date.
• Approved Personnel for Production System: After system go-live, access to service data by Approved Personnel requires authorization from customer and requires customer IT to grant access to Customer intranet. The access may be strictly for the purpose of direct responses to customer service requests and provide troubleshooting and service support.
• Audit: Quantium employees have unique accounts on infrastructure and cloud tools. These IDs are used to authenticate and identify each person’s activities on Quantium systems, including all access to Service Data.
• Data ownership: The client retains ownership rights to all Service Data processed by Quantium systems.
• No Sale of Service Data: Quantium will never sell, rent, or lease client Service Data to any third party.

Quantium strives towards security best practices and also completes yearly SOC 2 auditing. This is in line with our proactive approach to security risk management. The following are risk examples and Quantium’s risk mitigation approach for each:

• Exploitation attacks: These breaches are caused by vulnerabilities in outdated systems. Quantium caters for this by continuous code and version upgrades, while Microsoft Azure employs hosting on up-to-date hardware.
• Human error: There are multiple threats of breach that can arise from human error, such as the use of weak passwords, failure to apply security best practices, and lack of awareness about phishing and spoofing attacks. Quantium implements an ongoing policy requiring all employees to complete periodic security awareness training.
• Other system related vulnerabilities: Quantium completes periodical penetration tests including OWASP Top 10 Vulnerabilities and Database Vulnerabilities to test and proactively ensure that our system security is up to standard.

Additional measures to note:

• Our systems undergo security and compliance monitoring by leading security compliance service providers.
• As part of our HR policy, we conduct periodic ongoing training for all Engineering and Client Solutions staff on the latest data security policies and guidelines.
• As part of our client servicing initiatives, we conduct periodic training and information updates to our client’s administrators and users on security related topics.

No.

Access is restricted. Service Data is accessible only to authorized personnel and approved service providers, subject to appropriate security and confidentiality controls.

Quantium uses the Azure SQL managed database instance, which is a database–as–a–service offering under the PaaS model on the Azure cloud.

Azure database backup is done automatically to support “Point-in-time” restoration.

Currently Quantium offers 3 hosting regions:

1. European Union, United Kingdom, Norway and Switzerland (hosted in the Netherlands)
2. Southeast Asia (hosted in Singapore)
3. Mainland China

Quantium complies with GDPR regulations on storing and processing our clients’ data, with many measures in place to ensure we’re fulfilling our obligations. You can read more about our policies on data protection and processing in more detail throughout the rest of this webpage. To read our GDPR statement, click here.

Quantium maintains security and operational resilience controls designed to support clients’ compliance with applicable DORA requirements, including ICT third-party risk management. We work with regulated clients on the relevant contractual requirements. You can read more about how Quantium has prepared for DORA.