Information obtained by Accredion Qualis during the course of certification activities is treated as confidential and protected under a documented information security regime.
Scope of confidentiality
Confidentiality applies to information obtained about a client from any source — the client's application, the audit process, evidence collected, findings, personnel interviews, and any information gained about third parties (customers, suppliers or regulators of the client) during the audit.
Protection measures
- All personnel, contractors and committee members sign confidentiality undertakings.
- Client evidence is stored on encrypted systems with access limited to the audit team, technical reviewer and decision-maker.
- Systems used for certification records apply role-based access, per-file encryption at rest, and full audit logging of who accessed what and when.
- Evidence retention periods and secure destruction schedules are defined; clients are notified of the schedule in the certification agreement.
Circumstances in which information may be disclosed
- With the client's written consent.
- Where required by law or by a court order. The client is informed of the disclosure to the extent legally permitted.
- To accreditation or witnessing bodies assessing our operations, under equivalent confidentiality obligations.
- Public certification information — the fact of certification, certificate number, standard, scope and status — is public by design and published in the certified clients directory and via the certificate verification tool.
Complaints and confidentiality
The identity of a complainant is treated as confidential and disclosed only with consent, or where disclosure is required by law. See the Complaints and Appeals policy for details.
Retention
Audit records, decision records and evidence supporting a certification decision are retained for the duration of the certification cycle plus the period required by our records retention schedule. Records are securely destroyed on the schedule unless the client requests otherwise in writing.
