Quality & security policy
Quality, security and data protection policy
This policy governs every engagement the group accepts. It is reviewed annually by the quality management representative and approved by the management board.
Document control
- Document
- QP-001 Quality & Security Policy
- Version
- 4.2
- Effective
- 1 February 2026
- Next review
- 1 February 2027
- Owner
- Quality management representative
- Approved by
- Management board
Commitments
Evidence is produced with the work
Documentation is generated during engineering activity and placed under version control with the artefact it describes. Retrospective reconstruction of records is prohibited.
Independence of the quality function
The quality management representative reports to the management board, not to delivery. Release approval cannot be granted by the person who produced the work.
Risk-based effort
Control depth is proportionate to patient, financial and citizen risk, determined by documented assessment rather than by contract value.
Security by default
Least privilege, mandatory review, dependency scanning, SBOM generation and encrypted storage apply to every repository and environment, including internal ones.
Data minimisation
Production data is never used in development environments. Where realistic data is required, it is synthesised or irreversibly anonymised under a documented procedure.
Continuous improvement
Internal audits run on a fixed schedule. Findings become tracked corrective actions with owners and deadlines, closed only on verified effectiveness.
Operating controls
- —Documented SOPs for requirements, design, verification, release and maintenance
- —Mandatory peer review and automated static analysis on every change
- —Segregated environments with role-based access and quarterly access review
- —Encryption in transit and at rest; key management under documented custody
- —Supplier and open-source component assessment with SBOM maintained per release
- —Incident response with defined severity levels, notification duties and post-incident review
- —Business continuity and backup restoration tested twice yearly
- —Annual internal audit and management review of the quality system
Reporting a concern
Security vulnerabilities, data protection concerns and quality issues can be reported directly to the compliance address below. Reports are acknowledged within two working days and tracked to closure as corrective actions.
compliance@softsoft.kz