Security & Privacy
Privacy and cybersecurity controls
Because our platform may store names, locations, signatures, delivery details and potentially health information, we apply layered security controls.
Role-based access
Users see only the data their role requires — admin, dispatcher, driver or customer — limiting exposure of sensitive records.
Multifactor authentication for admins
Administrator MFA is a deployment requirement. Enforcement must be verified with the authentication provider before sensitive-data service activation.
Automatic logout
Sessions expire after a period of inactivity to protect unattended devices.
Encryption in transit and at rest
Hosting-provider encryption in transit and at rest must be documented and verified for the deployment before sensitive information is processed.
Audit logs
Supported custody and administrative actions create audit records for review. Complete view-access logging requires separate verification.
Minimum-necessary on driver screens
Drivers see only the shipment and stop information needed to complete a delivery — not full clinical or account data.
Remote account disabling
Administrators can disable access immediately when an account is compromised or no longer needed.
Data retention & deletion
Defined retention periods and deletion processes aligned to legal and contractual requirements.
Backup & recovery
The program records backup evidence and continuity tests. Hosting-provider backups and successful recovery must be verified before service activation.
Breach & incident reporting
Internal reporting and notification procedures for security incidents and potential breaches.
Vendor agreements
Required vendor Business Associate Agreements and data-processing terms must be executed and verified before protected information is processed.
Compliance approach
There is no general government-issued "HIPAA certification." QFO does not claim to be HIPAA certified. Instead, we use privacy, security, access-control, training, and documentation procedures designed for compliant operations, and we enter Business Associate Agreements with clients where applicable. These controls are part of a broader program of training, monitoring and continuous improvement.
Need details for your security review?
Discuss your delivery requirements and confirm service availability with QFO.