Security
What the product actually controls
ECONX GROUP (PTY) LTD builds QUALICORE. The controls below are in the application. They are not an ISO 27001 certificate, a SOC 2 report, a PCI DSS attestation or a HIPAA certification.
Sign-in
People sign in with email and a password. The API issues a JWT. Multi-factor authentication is not part of this login.
Roles
QA, supervisor, agent, ops, admin and client users see different dashboards. QA, supervisors and ops managers also need a client assignment.
Tenant separation
QA records are stored with a company id and a client id. Queries for those records include the company. This is application scoping, not a published penetration test.
Private files
CVs, HR documents and uploaded interaction recordings are excluded from the public /uploads static route.
Audit events
Selected actions insert an audit document with a user and a time. The log is not hash-chained and is not a write-once archive.
Retention
Records stay until a company turns enforcement on. A legal hold blocks deletion. There is no purge job running by default.
Recordings
An uploaded recording is stored for that company. It is not sent to a transcription provider from the import route.
Report a security issue
Email info@econxgroup.com. Include the page or API path and what you observed. Do not send passwords or full recordings in the first message.