Quadient Digital Trust Center

Quadient manages compliance to multiple certifications (e.g., ISO27001, ISO9001, HITRUST, PCI-DSS), frameworks (e.g., SOC2, NIST Cybersecurity Framework) and legal requirements (e.g., GDPR, HIPAA, ANDBR).

Actual compliance levels are reviewed multiple times per year by both internal audit teams and independent external auditors.

Quadient maintains dedicated Cyber Insurance with a …………………. Coverage.

All End-user Licence Agreements for Quadient software solutions are publicly available here https://www.quadient.com/en/eula. 

Quadient Privacy Statement is publicly available here https://www.quadient.com/en/quadient-website-privacy-statement.

Privacy Notice for California Residents can be found here https://www.quadient.com/en/california-consumer-privacy-act.

To be added

To be added

All Quadient users receive multiple awareness trainings throughout the year. From initial entry trainings (to be performed within first two weeks of employment and before any access to confidential or customer data), to repeated training and ad-hoc trainings focused on important topics.

Contents of the training are regularly updated and vary depending on the role of the employee. Such trainings cover Security, Privacy, Secure Development, Incident Management, Social Engineering, local legal requirements etc.

Attendance and completion of all trainings is regularly monitored by responsible teams.

Logical access rights are assigned to users within Quadient in line with Need to Know and Least Privilege principles. Access rights are managed using role-based account control (RBAC) approach and regular access rights review is taking place. Access rights are revoked/modified latest within 24 hours after user leaves Quadient or changes role. Systems have access rights matrix in place which highlights possibly conflicting roles. Such conflicts, if any, are quickly fixed by Asset Owners for the specific systems. Single-sign-on (SSO) and Multi-factor authentication (MFA) is utilized where needed. Multiple consecutive failed login attempts lead to locked account, which needs to be restored by admins.

Within Quadient solutions it is up to the selected customer’s admin, to setup access rights for rest of customer’s users and manage accordingly, including SSO and MFA.

Logical access rights are assigned to users within Quadient in line with Need to Know and Least Privilege principles. Access rights are managed using role-based account control (RBAC) approach and regular access rights review is taking place. Access rights are revoked/modified latest within 24 hours after user leaves Quadient or changes role. Systems have access rights matrix in place which highlights possibly conflicting roles. Such conflicts, if any, are quickly fixed by Asset Owners for the specific systems. Single-sign-on (SSO) and Multi-factor authentication (MFA) is utilized where needed. Multiple consecutive failed login attempts lead to locked account, which needs to be restored by admins.

Within Quadient solutions it is up to the selected customer’s admin, to setup access rights for rest of customer’s users and manage accordingly, including SSO and MFA.

Quadient uses Microsoft Azure (Azure) and Amazon Web Services (AWS) to store backups, together with dedicated Escrow provider.

Backup arrangements are made ensure compliance with Recovery Time Objective (RTO) of 12 hours and Recovery Point Objective (RPO) of 4 hours and their recovery tests are performed regularly to ensure, that backups are able to be used when needed.

Backups are stored in georedundant location, but always in a same geographic region (e.g., EU) to comply with relevant legislations and are subject to same security measures (e.g., encryption) as primary data.

Bring Your Own Device (BYOD) scheme is not supported by Quadient.

Business Continuity (BC) and Disaster Recovery (DR) Plans are created based on Business Impact Analysis (BIA) results by responsible Asset Owners. DR plans are tested at least twice per year, if they ensure compliance with Recovery Time Objective (RTO) of 12 hours and Recovery Point Objective (RPO) of 4 hours. BC plans are tested at least annually. Where possible, different type of tests and test approaches are used to ensure maximum efficiency of such exercises.

Action items from BC/DR plan tests are tracked, have clearly assigned owner, action plan and due date.

Change Management is closely linked with Risk Management in Quadient, as all changes present a degree of risk which needs to be evaluated and approved by appropriate authority.

To unify approach to changes, standardized methods and processes are in place. Centralized data repositories and automated tools are used when possible. Clear notification, escalation and approval channels are defined and communicated.

All data held by Quadient is encrypted. Quadient standard is AES 256bit for data at rest and TLS 1.2/HTTPS for data in transit.

Encryption keys for Quadient solutions are managed in a following way.

Assets in Quadient are subject to multiple industry best practice hardening measures. This includes (not full list):

• Antimalware tool with auto updated antimalware definitions
• Patched operation system
• Mobile Device Management (MDM)
• Storage encryption
• Auto-locking screens

All Quadient employees and contractors have contract in place, where security responsibilities are clearly specified. Non-Disclosure agreement (NDA) is signed and is valid even after the termination of employment or contract.

Background checks are performed in line with local legislation and can be in a form of criminal record check, credit check etc.

Users sign agreement to follow all Quadient Security and Privacy Policies, Code of Ethics and Code of Conduct.

Disciplinary Actions Policy is in place and can be used when noncompliance with Quadient policies is detected.

Security Incident Response Team (SIRT) is available within Quadient to ensure effective solving of any Security or Privacy related topics. Incident reporting channels are identified, together with clear escalation paths. Root cause is identified for any incident, together with its impact and lessons learned.

Action items from incidents investigations are tracked, have clearly assigned owner, action plan and due date.

Customers are only informed about incidents affecting them directly.

Throughout the year, multiple audits are taking place in Quadient, focused on different scopes, standards, frameworks and legal requirements. Such audits are performed by internal teams of skilled professionals, and at least annually confirmed by independent external party.

Findings from audits are tracked, have clearly assigned owner, action plan and due date.

Quadient stores security and audit logs to ensure traceability of important actions, in line with industry standards. Such logs include username, type of action, time stamp etc. and are kept for at least one year.

Logs are monitored by internal and external teams and suspicious events are deeply investigated.

Status page for customers is available, to inform about any planned or unplanned downtime.

• Beanworks -
• ICA platform -
• Quadient Impress -
• Quadient Inspire - https://university.quadient.com/group/site/quadient-cloud-status
• YayPay -

Quadient utilizes multiple technical tools within its network. This includes (not full list):

• Web filtering
• Firewall rules management
• Auto-terminated sessions
• Network zoning concept
• Virtual Private Networks (VPN)
• Intrusion Detection System (IDS)
• Zero Trust Architecture (ZTA)

Networking cables within offices are protected from interception, interference or damage. Wireless networks are protected by username/password (WPA2).

Network events are monitored by internal and external Secure Operations Center (SOC) teams and incidents are escalated and investigated according to internal procedures.

Data Loss Prevention tool (DLP) and Security Information and Event Management (SIEM) are not yet implemented within Quadient, but future implementation is regularly reviewed. Such solutions are substituted by other technical and administrative controls in place.

Passwords are assigned to unique user and is forbidden to share them. Their construction guidelines follow latest industry best practices, to ensure maximum security (therefore no forced changes after 3 months, usage of special characters etc.) Passwords use salt and are encrypted. Usage of password management tolls is recommended internally.

Within Quadient solutions, password management is configurable it is up to customer’s admin, to set it up according to their standards.

Quadient offices are protected by Close Circuit Television (CCTV) system, physical keys, ID cards and other controls. Zoning concept is implemented, to highlight more critical areas (e.g., server room, HR office). Only restricted number of users have access to such areas. Clean Desk Policy is implemented, and offices are locked and protected after business hours.

Physical and environmental security of datacenters is fully in responsibility of Azure and AWS.

Risk Management within Quadient is built around ISO 27005 and uses asset-based risk approach. All assets have dedicated owners, who are responsible that risks affecting assets in their responsibility are within Quadient defined acceptable levels, or there are risk treatment plans in place to modify such risks.

Risk assessment is performed at least annually and its results, together with proposed risk treatment plans, are approved by executive management.

Quadient incorporates security into its software development life-cycle using the OWASP SAMM framework, for more information on the SAMM project try https://owasp.org/www-project-samm/. Security by Design, Security by Default, Privacy by Design and Privacy by Default principles followed. Compliance regularly checked by internal QA/QE teams and confirmed by external independent parties. All code is tracked, version controlled, and peer review need to be done prior to deployment. Quadient uses separate development, test and live environments. Customer data are never used in development or test environments.

As Quadient solutions operate in cloud as SaaS model, there is a concept of shared responsibility. For some security aspects Quadient is solely responsible, for others customer is solely responsible and for the rest, the responsibility is shared.

Please reach out to your Account Manager if you are unsure of specific responsibilities.

Quadient understand risks relevant to supply chain management, and as a result regularly reviews its suppliers. New suppliers need to go through due diligence process, which is evaluated by multiple Quadient internal departments. Current suppliers are evaluated on periodic basis, at least annually. Type of review can go from self-assessment to full audit performed by independent third party and depends on the criticality of the supplier.

Quadient uses wide range of Vulnerability Assessments and Penetration Tests, which are performed based on approved schedule, starting from weekly frequency for specific assets.

They are performed by internal and external teams, together with industry leading tools (e.g., Qualys, Goose), utilizing both Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).

Identified vulnerabilities are fixed according to internal schedule, priority given to more critical vulnerabilities.

Brandon Batt, member of Quadient's Executive Management team, is Quadient's Data Protection Officer (DPO).

The DPO is supported at local/regional level by Regional Data Protection Officers (RDPO).

Customers are informed about data breaches directly affecting them latest within 48 hours after Quadient becomes aware of such data breach.

Quadient solutions are processing data which are provided by the customer. Such data can go from public data, dummy data up to Credit Card Data, Personal Identifiable Information (PII) and Personal Health Information (PHI).

Quadient is keeping the data for ….

Customer data are deleted from Quadient solutions within one week after contract is terminated.

You can contact us by using these options:

• Using the access request form here https://www.quadient.com/en/preferences
• Emailing Us at: PrivacyTeam@Quadient.com
• Calling Us at +1-800-636-7678

Quadient uses Microsoft Azure (Azure) and Amazon Web Services (AWS) as infrastructure (IaaS) for their SW solutions. Both Azure and AWS maintain a comprehensive set of certifications and assessments.

• Azure - https://www.microsoft.com/en-us/trust-center/product-overview
• AWS - https://aws.amazon.com/security/

Our data centers are located as follows:

Customer data is always staying in the same region for both primary and secondary locations.

Data submitted to Quadient by customers, and being processed within Quadient solutions, are processed and stored in multi-tenant environment, where logical segmentation (among other controls) is used to prevent co-mingling of customer data.

Quadient does not want and does not need access to customer data. In very exceptional circumstances (e.g., to solve specific problems on customer request) this can be arranged, but needs to be mutually agreed upfront.

Quadient regularly updates list of sub-processors used within their solutions. Such list is available to Quadient customers.

While majority of relevant reports are confidential and either Quadient does not share them, or only do so after NDA is signed, there are some reports which can be freely available on request.

For other reports and records from BC/DR tests, HIPAA/GDPR/CCPA assessments, vulnerability assessments and penetration tests, incidents resolution etc. please reach out to your Account Manager to discuss next steps.

In the context of the Ukraine conflict, Quadient has implemented a series of additional controls and measures to mitigate the risk of cyber attacks, whose threat level has recently increased.

• Strengthened authentication process on information systems
  • Multi factor authentication (MFA) is in place where it is required most, of course balancing risk vs productivity
• Increased security supervision, with the support from a specialist 3rd party
  • 24x7 monitoring of all of our key IT assets (e.g. devices, server / hosting, network access points etc.)
• Back-up of critical data and applications offline, which is standard practice at Quadient
• Prioritized list of the organization's critical digital services,
  • Classified as mission critical vs business critical vs standard, with heightened requirements around mission and business critical systems
• Reminder and re-enforcement of our cyberattack crisis management process across all departments involved

In case of questions, please contact security-group@quadient.com.