Brochure (PDF)Book a demoMenu
Security & privacy

Secure by design. Ready for anywhere.

Access control, privacy by design, a full audit trail, and the deployment you choose: cloud or on-premises.

Book a demoTalk to us about on-premises
Five layers of protection: network (HTTPS, TLS 1.2+ in the cloud), access (roles, per-request checks), data (AES-256-GCM, automatic deletion), devices (secret links, protection) and audit (who did what and when). NetworkHTTPS, TLS 1.2+ (cloud) AccessRoles, per-request checks DataAES-256-GCM, auto-delete DevicesSecret links, protection AuditWho did what and when
Controls in the product today

Four groups of controls, built in

Built into manageQ itself, and the same in the cloud and on your own servers unless marked “Cloud”.

Access & identity

  • SuperAdmin, admin and staff roles, plus custom roles set by the platform administrator
  • Each organisation’s data kept apart on every request; staff limited to their own locations
  • Passwords hashed with bcrypt (cost 12)
  • Accounts lock after 3 failed sign-ins; sign-in attempts are rate-limited
  • Sign-in sessions of 1–24 h per organisation, with optional idle sign-out
  • A user who is switched off loses access at their next action

Privacy by design

  • Visitor details encrypted (AES-256-GCM) and deleted after service or at day end
  • Booking details deleted the day after the appointment, or later if a location sets it
  • Per-mobile limits compare a keyed hash; mobile numbers are masked on tickets and lists
  • No personal data on dashboards or displays
  • Message texts carry no personal data
  • Secrets and personal data kept out of the application’s logs
  • Personal data replaced with placeholders before any AI model call

Audit & accountability

  • Every change recorded: who, what and when
  • Before and after values for queue-rule changes
  • Sign-ins, failed sign-ins and lockouts
  • Every view of a visitor’s details
  • The full timeline of every token
  • Audit-log explorer with CSV export (up to 50,000 entries); nobody can change or delete an entry

Platform & device hardening

  • Cloud: HTTPS only, TLS 1.2+, platform secrets in Azure Key Vault
  • A 192-bit secret link per kiosk or display, stored hashed and encrypted; replace or revoke it at once
  • Kiosk protection pauses a kiosk that sends far more than a person could, for an admin to review
  • Strict security headers, an allowed-origins list and request-size limits
  • Every input checked against strict validation rules
  • Automated tests and dependency audits on every change

“Cloud” items describe the Microsoft Azure set-up; on your own servers, they depend on your network and hosting.

Visitor data in India

Controls that support your DPDP duties

Under India’s Digital Personal Data Protection Act, 2023, your organisation decides why visitor data is collected. manageQ gives you the controls to collect less, keep it for a short time and show who looked at it.

  • Forms ask only the fields you set, service by service
  • A consent box for messages, which you can set to start unticked (opt-in)
  • STOP and START replies, and opt-outs that staff record at a visitor’s request
  • Visitor details deleted automatically after service; booking details after the appointment day
  • Every view of a visitor’s details written to the audit log
  • Your own servers in India when the data must stay on your premises

The Act places duties on your organisation as the data fiduciary: the notice you give, the purposes you choose and how you answer requests. manageQ supports those duties; it does not make the decisions for you, and we do not claim any certification.

Questions about a set-up for your sector? We go through them with you in the demo.

Deploy your way

In the cloud or on your own servers

The same manageQ in every set-up, with the database and the network you choose.

Microsoft Azure

The reference set-up: HTTPS only with TLS 1.2+, secrets in Azure Key Vault and managed identities between services.

On-premises or private cloud

Your servers in your country, with Docker. The database stays on your own network.

Classic install

Windows or Linux services behind your own HTTPS reverse proxy, for IT teams that prefer it.

  • PostgreSQL 13+ in every set-up
  • Database upgrades are additive and run at start-up
  • A documented rollback for every release
  • A health endpoint for your monitoring
Ready for any country

One platform for every location

  • Each location keeps its own time zone, hours and holidays
  • Customer screens and voice announcements in 6 languages, Arabic right to left
  • Service names, texts and forms in any script
  • International phone numbers with the country code, and e-mail checks
  • DLT-registered SMS templates for India (MSG91)
  • Self-host in your own country when data must stay there

Customer screens and voice announcements in

  • English
  • हिन्दी
  • తెలుగు
  • தமிழ்
  • العربية
  • Русский
Clocks at 09:00, 13:30 and 17:00 for locations in different time zones, with six voice languages and cloud or on-premises hosting. 09:0013:3017:00Any time zone6 voice languagesCloud or on-premises
AI assistant

The assistant follows the same rules

It sees only what the person’s role allows, changes nothing without a Confirm, never browses the internet and replaces personal data with placeholders before any model call.

Read the assistant’s guardrails
Coming soon

On the security roadmap

  • Single sign-on & 2FA
  • OTP-verified mobile numbers

Scope and timing to be confirmed.

Found a security issue?

Please tell us privately before you share it with anyone else, and include the steps to reproduce it.

Write to [PH: security e-mail].

Run it in the cloud or on your own servers

Book a demoTalk to us about on-premises
  1. Discovery call
  2. Live demo with your set-up
  3. Pilot at one location
  4. Roll out with guides for every role
Book a demo