Legal

Security & Data Processing

Last updated: 5 November 2026

QXP is designed to protect the data schools entrust to us. This page summarises our approach to security, data processing, and our responsibilities.

Our role in data processing

Website and marketing: when you submit a form on our website (demo request, contact, pricing enquiry, Get Started order), QXP acts as a data controller. Platform data: when a school uses QXP to run the school — academics, fees, payroll and administration — QXP acts as a data processor on behalf of the school (the data controller). The school determines what data is entered and how it is used.

Security measures

We implement reasonable technical and organisational measures, including: tenant isolation - each school's data lives in its own separate database, so one school cannot read another's by construction, rather than by a filter someone has to remember to apply; role-based access control with granular, per-campus permissions; and a full audit trail on user actions. We are not independently security-audited and do not claim to be. If your procurement process needs specifics on encryption, hosting or data handling, ask us at info@qxp.global and we will answer precisely rather than in marketing copy.

Data Processing Agreements

Institutional customers may request a Data Processing Agreement (DPA) that formalises our obligations as a data processor. To request a DPA or vendor security review materials, contact us at info@qxp.global.

Infrastructure

QXP is hosted on DigitalOcean infrastructure in data centres in the United States. We select infrastructure providers based on their security certifications, uptime track record, and data protection capabilities.

Subprocessors

We use a limited number of third-party service providers (subprocessors) to deliver QXP. Current subprocessors: DigitalOcean (infrastructure hosting, USA); Cloudflare (network delivery and security - platform traffic passes through its servers, USA); Expo (delivers push notifications to the QXP mobile app, USA); and Google (Gmail API, used to deliver transactional email such as password resets and enquiry notifications, USA). Where the site chat assistant is switched on, Anthropic (USA) receives the message a visitor types and the conversation so far, in order to generate a reply. Where a school messages parents outside the platform, Meta (WhatsApp Cloud API) receives the recipient's number and the message — on the school's own Meta Business account where it has one, and on QXP's where it does not — and Africa's Talking receives the same for SMS, on QXP's own account, as there is no per-school SMS option. QXP is paid for its own subscriptions by M-Pesa Paybill, PesaLink or bank transfer, and uses no card processor. Where a school enables fee collection, the platform authenticates to Safaricom using that school's own Daraja credentials and shortcode, so Safaricom acts under the school's contract rather than as our subprocessor. We maintain an up-to-date list and notify customers of material changes. For the full subprocessor list, update notifications, or a DPA, contact info@qxp.global.

Vulnerability disclosure

We welcome responsible security research. If you discover a potential security vulnerability in QXP, please report it to info@qxp.global. Please include: a description of the vulnerability; steps to reproduce; your contact information. We ask that you: do not access or modify data belonging to other users; do not perform testing that degrades service for other users; do not disclose the vulnerability publicly before we have had reasonable time to address it. We aim to acknowledge reports within 48 hours and provide an initial assessment within 5 business days. We will not pursue legal action against researchers who act in good faith and comply with this policy.

Contact

Privacy and security: info@qxp.global. General: sales@qxp.global. WhatsApp message: +254 700 779 977.