Security at Qubic3D

You should tweak anything that is not 100% true for how you actually run things (cloud, encryption, backups, etc.) so you're not over-promising.

1. Security principles

Our security approach is guided by a few simple principles:

• Minimise data – collect only what we need to deliver the service.
• Least privilege – give staff and systems only the access they actually require.
• Defence in depth – multiple layers of controls (infrastructure, network, app, device).
• Secure by default – sane defaults for passwords, device lock-down and access.
• Transparency – clear communication about incidents, changes and responsibilities.

2. Infrastructure & hosting

• Qubic3D services are hosted on reputable cloud providers with strong security controls and certifications (e.g. ISO 27001, SOC 2, etc. – update to what you actually use).
• Production environments are segmented from development and testing environments.
• Administrative access to cloud infrastructure is tightly restricted and protected with multi-factor authentication (MFA).
• Access, configuration changes and deployments are logged for audit and troubleshooting.

3. Data encryption

In transit

• All browser and API traffic to Qubic3D is encrypted using HTTPS/TLS.
• Insecure protocols (plain HTTP) are redirected to HTTPS where possible.

At rest

• Databases and file storage are encrypted at rest using industry-standard encryption mechanisms provided by our cloud provider.
• Backups and snapshots are also stored in encrypted form.

4. Access control & identity management

• Staff accounts use unique logins with strong password requirements and multi-factor authentication wherever supported.
• Access to systems and data is granted based on role and job function (principle of least privilege).
• Access rights are reviewed periodically and revoked when no longer required (e.g. when employees change roles or leave).
• Admin tools and dashboards are not exposed to the public internet without authentication.

5. Application security

• We follow secure development practices, including code review and change management.
• Secrets (API keys, database passwords, etc.) are stored in secure secrets management tools, not hard-coded into source code.
• We use a combination of automated checks and manual review to detect common vulnerabilities (such as injection, XSS and insecure direct object references).
• Third-party libraries are monitored and updated regularly to reduce exposure to known vulnerabilities.

6. Network & platform security

• Firewalls and security groups restrict network access to only the ports and services that are required.
• Management interfaces are limited to specific administrative accounts and networks.
• Rate limits and other controls are used to reduce the impact of brute-force attempts and abuse.
• Centralised logging and monitoring are used to detect unusual behaviour and operational issues.

7. Tablet & device security

Because Qubic3D runs on tablets inside vehicles, device security is a key part of our model.

Where Qubic3D manages or configures tablets, we aim to:

• Run devices in kiosk / lock-down mode so that only approved Qubic3D apps or content can be used during operation.
• Apply screen-lock and basic OS protections to prevent casual tampering.
• Use remote configuration and management (where supported) to enforce app updates and basic policies.
• Avoid storing unnecessary personal data on the tablet itself – most sensitive data is processed on secure servers, not on the device.
• Log device status (e.g. online/offline, battery, playback state) to monitor health and detect anomalies.

Drivers and fleet owners are instructed not to:

• attempt to bypass kiosk mode or root/jailbreak devices;
• install unapproved apps that could compromise security; or
• share tablets with third parties for non-Qubic3D purposes.

8. Data retention, backups & reliability

• Operational data is backed up on a regular schedule to support recovery from hardware failure or operational issues.
• We retain data only for as long as reasonably necessary for operational, reporting, legal and accounting purposes, as described in our Privacy Policy and contracts.
• Where practicable, personal data is pseudonymised or aggregated to reduce sensitivity for analytics and reporting.

9. Third-party services & subprocessors

Qubic3D uses selected third-party providers for infrastructure, analytics, communications and payments. When we engage a third party to process data on our behalf:

• we assess their security posture and reputation;
• we sign appropriate data protection and confidentiality agreements where required; and
• we limit the scope of data they receive to what is necessary to perform their function.

A list or description of key subprocessors can be provided to enterprise customers on request.

10. Incident detection & response

Even with strong controls, no system can be guaranteed 100% secure. If something goes wrong, we aim to respond quickly and transparently.

Our incident process generally includes:

1. Detection – automated alerts, logs, and internal reports from staff, customers or partners.
2. Assessment – classify the severity and impact (systems affected, data types, geography).
3. Containment & remediation – isolate affected components, revoke credentials, apply patches, and strengthen controls.
4. Notification – where required by law or contract, we will notify affected customers and/or regulators within the applicable timeframes.
5. Post-incident review – analyse root cause, document lessons learned, and implement improvements.

11. Your responsibilities

Security is a shared responsibility between Qubic3D and our users.

You can help protect your account and data by:

• using strong, unique passwords and enabling MFA where available;
• restricting dashboard access to authorised team members only;
• promptly removing access for users who leave your organisation;
• treating reports and login details from Qubic3D as confidential; and
• notifying us immediately if you suspect unauthorised access or believe your credentials have been compromised.

Drivers and fleet owners should:

• keep tablets physically secure and out of sight when the vehicle is unattended;
• promptly report lost or stolen devices so that we can take appropriate action;
• avoid connecting tablets to untrusted Wi-Fi networks where possible.

12. Reporting a security issue

If you believe you have found a security vulnerability or incident affecting Qubic3D, please contact us as soon as possible.

• Email: security@qubic3d.co.za (or support@ if you prefer)
• Subject line: “Security issue – [short description]”

Please include:

• a detailed description of the issue;
• steps to reproduce (if known);
• any relevant screenshots, logs or URLs; and
• your contact details so we can follow up.

We ask that you:

• don’t publicly disclose the issue until we have had a reasonable opportunity to investigate and fix it; and
• avoid accessing, modifying or deleting data that does not belong to you.

We appreciate responsible disclosure and will treat all good-faith reports seriously.

13. Changes to this Security statement

We may update this Security page from time to time to reflect improvements or changes to our practices. When we do, we’ll update the “Last updated” date at the top.

If you have questions about any part of this page, you can reach us at:

Qubic3D
Email: security@qubic3d.co.za / support@qubic3d.co.za