Diligence
Security, Infrastructure, and Client Audits
Most of what follows is normally extracted from a vendor over three weeks of questionnaires. It is here instead.
Certifications, With the Numbers
Most vendors show you a logo. Here are the certificate numbers, and the registers—you can check them in without contacting us.
| Certification | Certificate | Verify It Yourself |
|---|---|---|
| ISO/IEC 27001:2022 Information Security Management |
IS 791318 | Search the certificate number in the IAF CertSearch public register, the global database of accredited certifications. Issued by BSI. |
| ISO 9001:2015 Quality Management System |
Q-9130084915 | Also searchable by certificate number in IAF CertSearch. |
| HIPAA Certificate of Conformance |
Intertek | There is no accreditation body or central register for HIPAA — anyone claiming to be "HIPAA certified" is describing something that does not exist. What exists is an independent assessment against the applicable requirements. Ours was performed by Intertek, and you can confirm the certificate is genuine and current through Intertek's certificate validation service. |
| Client Security Audits Ongoing, on site |
Continuous | Fortune 100 clients send their own people to audit our delivery centers, and the engagements continue afterwards. We do not hand our internal control documentation to third-party attestation programs, which is a deliberate choice and the reason we do not offer a badge in this row. If your security team wants to audit us, that is the answer we prefer anyway—bring them. |
The certificates are held by bebo Technologies, the entity that operates our India delivery centers.
That is deliberate, and it is how this works across the industry: a certification should sit with the organization that actually does the work, is audited on its floors, and runs the controls being certified—not with the office that signs the contract. The engineers on your account work under those controls every day.
The Assurance We'd Point to First
Fortune 100 clients audit our delivery centers on-site regularly. They send people to look at the floors, the access controls, the network segregation, and the processes, and they write their findings without any interest in flattering us.
Those engagements continue afterward. That is a stronger statement about our controls than any certificate we could display, because we didn't write it and we couldn't have.
Prospective clients are welcome to audit us too, before signing anything.
Physical and Network Controls
- Dedicated Client Floors: Engagements that require it get physically separated working areas rather than shared open floor.
- Badge-Controlled Access: Entry is controlled and logged at the floor level, not only at the building entrance.
- Network Segregation: Engagements are separated at the network layer, so one client's environment is not reachable from another's.
- Client Environments: Where required, engineers work entirely inside your environment, under your access control, with nothing leaving it.
- Device Lab: Over 500 device and platform configurations for mobile, web and desktop validation, maintained in-house.
Continuity
Two fully operational delivery locations in India, each able to carry the other's work, plus a full engineering center in Aguascalientes, Mexico, and leadership in Pleasanton. Business continuity is a tested arrangement rather than a document.
The commercial side matters here too: QASource is founder-owned, debt-free, and has been profitable since 2002, with no outside institutional capital. Vendor financial failure is a continuity risk that most diligence processes ask about, and few vendors can answer this plainly.
Data and AI Handling
- No client data is used to train or prompt external models.
- Generation runs in controlled environments, under client-defined access.
- Every AI-generated asset is reviewed by an engineer before it is committed.
- QASource Intelligent Platform (QASIP) is internal and never leaves our control; you receive its output, not the platform.
Send Us Your Security Questionnaire
We would rather answer it now than at the end of a procurement cycle.