Last updated: 3 June 2026

1. Introduction

At The Quantum HQ, LLC (“Quantum HQ”, “we”, “our”, or “us”), information security is central to the way we deliver outsourced bookkeeping, accounting support, reporting, finance operations, administrative support, and related business services.

We work with accounting firms, financial advisors, consultants, and small and medium-sized businesses. As part of this work, we may handle confidential business information, financial records, accounting records, client information, and personal data. We recognise that this information is a valuable asset and we are committed to protecting it through appropriate technical, organisational, physical, and administrative safeguards.

This Security Policy explains the security principles, controls, and practices followed by Quantum HQ to protect information from unauthorised access, loss, misuse, alteration, disclosure, or destruction.

2. Scope of this Policy

This policy applies to:

• Quantum HQ employees, contractors, consultants, and authorised users;
• Systems, devices, applications, workstations, cloud platforms, and networks used for Quantum HQ business operations;
• Information received from clients, website visitors, vendors, employees, and business contacts;
• Personal data and confidential business data processed by Quantum HQ;
• Physical and remote working environments used for service delivery.

This policy should be read together with our Privacy Policy, client service agreements, data processing terms, confidentiality obligations, and internal IT policies.

3. Information Security Management System

Quantum HQ follows an information security management approach aligned with recognised information security practices, including the principles of ISO/IEC 27001 for Information Security Management Systems.

Our information security programme is designed to support:

• Confidentiality of client and business information;
• Integrity of accounting, financial, operational, and reporting data;
• Availability of authorised systems and business-critical information;
• Accountability for access, handling, and processing of information;
• Continuous review and improvement of security controls.

Where Quantum HQ holds an active certification, certificate details may be published on this page. If a certification is not active or has not yet been independently verified, Quantum HQ will describe its practices as aligned with recognised standards rather than certified under them.

4. Security Governance

Quantum HQ maintains internal security governance practices to ensure that information security risks are identified, assessed, and managed appropriately.

Our governance practices include:

• Assignment of responsibility for information security oversight;
• Internal security policies and procedures;
• Access control and user management processes;
• Security awareness and staff training;
• Incident reporting and escalation procedures;
• Supplier and third-party risk review where applicable;
• Periodic review of security practices and controls.

5. Access Control

Quantum HQ restricts access to information systems and data to authorised users only.

Our access control practices include:

• Role-based access to systems and client data;
• Access granted on a need-to-know and least-privilege basis;
• Unique user accounts wherever practical;
• Password protection and secure authentication controls;
• Multi-factor authentication where available and appropriate;
• Review, modification, and removal of access when roles change or when users leave;
• Administrative access limited to authorised personnel;
• Monitoring and review of access to sensitive systems where appropriate.

Employees and authorised users must not share passwords, login credentials, client data, or confidential files with unauthorised individuals.

6. Data Transfer and Data Handling Controls

All transfers of client data and confidential information must be carried out through approved communication channels and authorised systems.

Quantum HQ applies controls to reduce the risk of unauthorised disclosure, including:

• Controlled access to client files and business systems;
• Restrictions on unauthorised downloads, copying, or sharing of client information;
• Use of secure file transfer methods where required;
• Internal guidance on handling confidential accounting, bookkeeping, payroll, tax, and business records;
• Prohibition on using unauthorised personal email, consumer file-sharing tools, or unapproved applications for client work;
• Confidentiality obligations for employees and contractors.

Client information must only be used for the purpose of delivering agreed services or as otherwise authorised by the client or required by law.

7. Workstation and Endpoint Security

Quantum HQ uses security controls to protect workstations, laptops, and other business devices used for service delivery.

These controls may include:

• Enterprise-level antivirus and anti-malware protection;
• Operating system and software updates;
• Password-protected devices;
• Screen lock and session timeout controls;
• Restriction or blocking of unauthorised removable storage devices such as USB drives, pen drives, and external storage media;
• Limitation of local administrator privileges;
• Secure configuration of business workstations;
• Device monitoring and support where applicable.

Employees and authorised users are expected to use company-approved systems and follow internal IT policies when handling business or client information.

8. Network, Firewall, and Internet Controls

Quantum HQ uses network security measures designed to reduce exposure to cyber threats.

These may include:

• Boundary firewalls and network gateways;
• Secure configuration of routers, systems, and business applications;
• Filtering or restriction of high-risk websites, unauthorised storage platforms, FTP services, and unsafe online destinations where appropriate;
• Protection against malware, phishing, and suspicious network activity;
• Monitoring of network activity where lawful and appropriate;
• Restriction of access to internal systems to authorised users.

Internet access is provided for business purposes and may be managed, filtered, or monitored in accordance with applicable law and internal policy.

9. Cyber Security Controls

Quantum HQ maintains cyber security controls aligned with recognised baseline cyber security practices, including the Cyber Essentials control areas.

These include:

1. Firewalls and gateways
   We use firewall and gateway controls to help protect business systems from unauthorised access and external threats.
2. Secure configuration
   Systems and devices are configured to reduce unnecessary services, default settings, and avoidable vulnerabilities.
3. User access control
   Access to systems and data is restricted to authorised users and reviewed where appropriate.
4. Malware protection
   Workstations and systems are protected using anti-malware, antivirus, and related security tools where applicable.
5. Security update management
   Supported software, operating systems, and security tools are updated and patched to reduce known vulnerabilities.

Quantum HQ also promotes secure working practices, phishing awareness, password hygiene, and appropriate reporting of suspicious activity.

10. Patch Management and Vulnerability Management

Quantum HQ applies patch management practices to reduce the risk of exploitation of known vulnerabilities.

Our practices may include:

• Applying operating system and application security updates;
• Removing, replacing, or restricting unsupported software;
• Reviewing critical vulnerabilities affecting business systems;
• Coordinating with vendors or service providers to address identified risks;
• Maintaining reasonable change management practices for important system updates.

11. Physical Security

Quantum HQ maintains physical security controls for operational areas where business and client information may be accessed.

These controls may include:

• Restricted access to operations areas;
• Authorised entry for department members and approved personnel only;
• Door access controls such as magnetic locking mechanisms where applicable;
• Visitor management procedures;
• Security personnel or building-level security where available;
• CCTV monitoring in office or facility areas where applicable and lawful;
• Clear desk and secure storage practices for sensitive documents.

Physical security controls may vary by location, building, and service delivery environment.

12. Remote Working Security

Where remote or hybrid work is authorised, Quantum HQ requires users to follow secure working practices.

These may include:

• Use of approved devices, systems, and applications;
• Secure authentication and password protection;
• Avoiding use of public or shared devices for client work;
• Protecting screens and documents from unauthorised viewing;
• Using secure internet connections wherever possible;
• Prohibition on storing client data on unauthorised personal devices;
• Reporting lost devices, suspicious emails, or security incidents promptly.

13. Cloud and Application Security

Quantum HQ may use cloud-based business systems, accounting platforms, reporting tools, communication tools, CRM tools, productivity applications, and secure storage platforms to deliver services.

Where applicable, we apply controls such as:

• User access permissions;
• Secure authentication;
• Data access restrictions;
• Vendor account management;
• Backup and recovery settings where available;
• Audit logs or activity monitoring where supported;
• Review of third-party service providers where appropriate.

Quantum HQ expects employees and authorised users to access client systems only through approved methods and only for authorised business purposes.

14. Confidentiality and Client Data Protection

Quantum HQ treats client data, financial information, accounting records, payroll information, tax information, business records, login credentials, reports, and correspondence as confidential.

We require authorised personnel to:

• Access client information only when necessary for assigned work;
• Protect client information from unauthorised disclosure;
• Avoid discussing confidential information in public or unsecured environments;
• Use approved systems for storage and communication;
• Follow client-specific security requirements where agreed;
• Return, delete, or restrict use of client information when required by contract or law.

15. Third-Party and Supplier Security

Quantum HQ may use third-party platforms, software providers, hosting providers, IT service providers, communication tools, accounting systems, analytics tools, or other vendors to support business operations.

Where appropriate, Quantum HQ assesses third-party services based on factors such as:

• Security features;
• Access control capabilities;
• Data protection practices;
• Contractual safeguards;
• Business need;
• Availability and reliability;
• Confidentiality and processing obligations.

Third parties are expected to process information only as authorised and in accordance with applicable agreements and legal requirements.

16. Backup, Recovery, and Business Continuity

Quantum HQ applies reasonable backup and recovery practices to support continuity of business operations and reduce the impact of system failure, accidental deletion, cyber incidents, or operational disruption.

These practices may include:

• Backup of business-critical information where applicable;
• Use of cloud platforms with recovery features;
• Access to alternative communication channels where appropriate;
• Incident escalation and continuity planning;
• Review of recovery practices for important systems.

17. Logging, Monitoring, and Audit

Quantum HQ may monitor systems, access logs, email security events, device health, login activity, and application activity to protect business operations and client information.

Monitoring may be used to:

• Detect unauthorised access;
• Investigate suspicious activity;
• Support cyber security controls;
• Maintain service quality;
• Protect confidential information;
• Comply with legal, regulatory, contractual, or audit requirements.

Monitoring is carried out in accordance with applicable law and internal policies.

18. Security Awareness and Training

Quantum HQ periodically makes users aware of IT policies, data protection responsibilities, and security measures.

Training and awareness may cover:

• Phishing and social engineering risks;
• Password and authentication practices;
• Confidentiality obligations;
• Safe handling of client information;
• Secure use of cloud applications;
• Incident reporting procedures;
• Data protection and privacy basics.

19. Incident Response

Quantum HQ maintains procedures for reporting, investigating, and responding to security incidents.

Security incidents may include:

• Suspected unauthorised access;
• Lost or stolen devices;
• Malware or ransomware alerts;
• Phishing or credential compromise;
• Accidental disclosure of client or personal data;
• Unauthorised changes to business systems;
• Breach of confidentiality obligations.

Where required, Quantum HQ will notify affected clients, individuals, regulators, or other parties in accordance with applicable law, contract, and regulatory requirements.

20. Data Breach Notification

If a data breach occurs, Quantum HQ will assess the nature and scope of the incident, the type of information involved, the likely impact, and the steps needed to contain and remediate the incident.

Depending on the applicable law and our role in processing the data, notification may be made to:

• The affected client;
• Affected individuals;
• Relevant regulators or supervisory authorities;
• Law enforcement or cyber security authorities where appropriate.

Where Quantum HQ acts as a processor or service provider for a client, we will follow the incident notification process set out in the relevant client agreement.

21. Compliance with Applicable Laws

Quantum HQ aims to handle information in accordance with applicable privacy, data protection, confidentiality, cyber security, and business laws in the jurisdictions where we operate or serve clients.

This may include, where applicable:

• UK data protection laws, including the UK GDPR and Data Protection Act 2018;
• United States federal and state privacy, consumer protection, and data security laws;
• Australian privacy laws, including the Privacy Act 1988 and Australian Privacy Principles where applicable;
• Indian digital personal data protection requirements, including the Digital Personal Data Protection Act, 2023 as applicable;
• Contractual confidentiality and data processing obligations agreed with clients.

22. Certifications and Recognitions

Quantum HQ may publish security certifications, audit reports, badges, or recognitions on this page only where they are current, accurate, and supported by appropriate evidence.

If we refer to a standard, framework, or security scheme, this does not automatically mean that Quantum HQ is independently certified unless a valid certificate or verification is specifically stated.

23. Responsibility of Users

All employees, contractors, consultants, and authorised users are responsible for protecting information and following security policies.

Users must:

• Use approved systems and devices;
• Protect passwords and login credentials;
• Report suspicious activity promptly;
• Avoid unauthorised data sharing;
• Follow client-specific instructions;
• Maintain confidentiality;
• Comply with internal security policies and applicable law.

24. Review of this Policy

Quantum HQ may update this Security Policy from time to time to reflect changes in our business, legal obligations, technology, security practices, or services.

The latest version will be published on our website.

25. Contact Us

For security-related queries, concerns, or reports, please contact us:

The Quantum HQ, LLC
USA: 850 Greenside Drive, Richardson, TX 75080
UK: 27 Old Gloucester Street, London, WC1N 3AX
India Office: SFX14, 69/1854 A1, INNERSPACE, SRM Road, near Nirmala Shishu Bhavan, Kaloor, Kochi, Kerala 682018

Email: info@thequantumhq.com
USA Phone: +1 469 638 2444
UK Phone: +44 33 0001 0090