Security Policy Breakdown
Security Governance & Defense Philosophy
At Qim Lab Enterprise (SSM Registration: 202603007186 / 003810616-X), security is not an isolated departmental function—it is a core organizational discipline woven into every stage of our digital engineering, civil maintenance, and precision manufacturing workflows.
We operate on modern information security frameworks designed to safeguard our subscribers, enterprise clients, physical worksites, and proprietary intellectual property. Our approach is grounded in three architectural tenets:
Zero Trust Architecture
"Never trust, always verify." Every network transaction, API invocation, and administrative interaction is explicitly authenticated, authorized, and continuously monitored.
Defense-in-Depth
Redundant protection layers spanning perimeter Web Application Firewalls (WAF), host isolation, strict network segmentation, and application-level authorization gates.
Principle of Least Privilege
User accounts, microservices, and internal personnel are strictly constrained to the minimum set of permissions necessary to execute their assigned tasks.
Cloud Infrastructure & SaaS Application Security (QL Studio)
Our software division, QL Studio, architects and maintains robust multi-tenant software platforms, notably our flagship educational enterprise SaaS, Campus Hub (campushub.my), as well as custom-built web and mobile solutions.
Multi-Tenant Data Isolation & Partitioning
Campus Hub SaaSCampus Hub enforces logical database tenant partitioning and strict Row-Level Security (RLS) across all institution clusters. An educational institution or enterprise subscriber can only access records matching their unique, cryptographically validated tenant identifier. Cross-tenant leakage is prevented at both the application business logic layer and database engine level.
Perimeter Defenses & DDoS Mitigation
All external web traffic routes through enterprise-grade cloud reverse proxies featuring continuous Distributed Denial of Service (DDoS) scrubbing (Layers 3, 4, and 7). Advanced Web Application Firewall (WAF) rules dynamically inspect incoming requests to neutralize malicious payloads, including SQL Injections (SQLi), Cross-Site Scripting (XSS), Local/Remote File Inclusion (LFI/RFI), and automated credential-stuffing bots.
Secure Software Development Life Cycle (SDLC)
- Peer-Reviewed Code: Direct commits to production branches are blocked. Every line of code undergoes mandatory multi-engineer peer review.
- Automated Security Pipelines: Automated Continuous Integration (CI) pipelines run Static Application Security Testing (SAST) and Software Composition Analysis (SCA) to detect known CVE vulnerabilities in third-party libraries.
- Secret Scanning: Automated pre-commit hooks and repository monitors actively scan codebases to prevent accidental exposure of API keys, private tokens, or database credentials.
- Container Isolation: Microservices run within hardened, non-root Linux containers with read-only root filesystems and minimal base images to minimize attack surfaces.
Data Encryption & Cryptographic Standards
We employ industry-vetted, non-deprecated cryptographic algorithms to guarantee the confidentiality, authenticity, and integrity of all client and institutional data.
- TLS 1.3 / 1.2: All HTTP traffic is forcefully upgraded to TLS 1.3 (with TLS 1.2 fallback). Unencrypted HTTP port 80 connections are automatically rejected.
-
HSTS Preloading: HTTP Strict Transport Security (HSTS) with
max-age=31536000; includeSubDomains; preloadprevents downgrade and SSL-stripping attacks. - Modern Cipher Suites: Only secure ciphers providing Perfect Forward Secrecy (PFS), such as ECDHE-ECDSA-AES128-GCM-SHA256 and CHACHA20-POLY1305, are enabled.
- AES-256 Bit Encryption: All relational databases, document collections, disk volumes, and object storage buckets are encrypted using industry-standard AES-256.
- Automated Key Management: Cryptographic keys are generated and rotated automatically via FIPS 140-2 Level 3 Hardware Security Modules (HSMs).
- Immutable Off-Site Backups: Daily automated database snapshots are encrypted and replicated to secondary geographical regions with Write-Once-Read-Many (WORM) retention guards.
Payment Processing & Financial Transaction Security
To ensure total financial integrity, Qim Lab Enterprise delegates all online payment processing to regulated, tier-1 financial infrastructure providers licensed under Bank Negara Malaysia (BNM).
Zero Cardholder Data Retention (PCI-DSS Level 1 Compliance)
PCI-DSS AlignedWe never store, log, or process sensitive credit or debit card data on our servers. Full Primary Account Numbers (PAN), CVV/CVC verification codes, expiration dates, and online banking credentials never touch Qim Lab Enterprise infrastructure.
Payment fields are hosted in PCI-DSS Level 1 compliant iframes.
Payment notification callbacks are verified using cryptographic SHA-256 HMAC signatures with secret salts.
Direct invoice transfers clear through Bank Negara Malaysia's secure Real-Time Retail Payments Platform (RPP).
Identity, Authentication & Access Controls
Unauthorized access is defended through a unified Identity and Access Management (IAM) framework across our client portals, SaaS subscriber platforms, and internal administrative tooling.
Mandatory Two-Factor Authentication (2FA) is enforced for all internal staff, cloud infrastructure consoles, and institutional administrator accounts on Campus Hub. Time-based One-Time Password (TOTP) algorithms and FIDO2 WebAuthn security hardware keys are natively supported.
User passwords are treated as zero-knowledge secrets. We compute cryptographic digests using memory-hard Argon2id algorithms with distinct per-user cryptographic salts. Passwords are never stored in plaintext, reversible formats, or weak hashes (MD5, SHA1).
User authentication tokens are issued as cryptographically signed, short-lived tokens.
Web cookies are strictly flagged with HttpOnly, Secure, and SameSite=Strict attributes
to neutralize session hijacking and CSRF threats.
Granular permissions delineate student, instructor, administrator, and superuser capabilities within our SaaS products. Internal staff access to production customer environments requires just-in-time access approval and generates immutable audit trails.
Blueprint, CAD & Workshop Security (QL Fabrication)
Our precision fabrication division, QL Fabrication, handles sensitive technical assets, including proprietary mold drawings, aerospace-grade turning geometries, and client-confidential CAD/CAM schematics. We protect your industrial trade secrets with rigorous digital and physical measures.
Confidential CAD/CAM File Custody
Client-supplied 3D CAD files (STEP, IGES, Parasolid, DXF) and G-code programs are stored in encrypted, access-restricted repositories. They are strictly designated for toolpath programming and machining execution, never shared with third parties or repurposed for competing jobs.
Air-Gapped CNC Controller Networks
Our computer numerical control (CNC) lathe, milling machines, and wire cutting controllers operate on isolated, air-gapped workshop local area networks (LANs) without direct outbound internet access, mitigating risks of industrial cyber-espionage or firmware tampering.
Binding Non-Disclosure Agreements (NDAs)
Every machinist, design engineer, and workshop technician at Qim Lab Enterprise signs legally binding confidentiality agreements protecting client designs, proprietary alloy selections, and dimensional tolerances.
Physical Workshop Surveillance
Active machining floors, finished component vaults, and prototype inspection rooms are monitored 24/7 via closed-circuit television (CCTV). Physical entry is restricted to authorized operations personnel.
Electrical & Site Operational Safety (QL Civil)
Our civil and infrastructure engineering division, QL Civil, conducts commercial electrical installations, power distribution wiring, renovation, and structural maintenance. Physical site safety, life-safety standards, and environmental compliance are paramount.
DOSH / JKKP & OSHA Compliance
Field operations comply strictly with the Occupational Safety and Health Act 1994 (OSHA) enforced by the Malaysian Department of Occupational Safety and Health (DOSH / JKKP). All technicians wear certified Personal Protective Equipment (PPE).
Lockout / Tagout (LOTO) Protocols
Before performing electrical maintenance, isolation switches are padlocked and tagged out. Circuit insulation resistance and residual current devices (RCD) are rigorously tested before energization to prevent electrical fires or shocks.
Vulnerability Disclosure Program & Incident Response
We deeply value the contributions of independent cybersecurity researchers, bug bounty hunters, and the white-hat security community in keeping our software and users safe.
If you conduct vulnerability research in good faith and adhere to these guidelines, Qim Lab Enterprise provides our unconditional commitment to Safe Harbor: We will not initiate legal action, contact law enforcement, or pursue civil damages against ethical researchers.
- Testing our public domains (qimlab.com.my, campushub.my)
- Reporting vulnerabilities with clear reproduction steps
- Allowing a reasonable timeframe before public disclosure
- Maintaining strict confidentiality of any discovered data
- Denial of Service (DoS/DDoS) attacks or rate exhaustion
- Social engineering, phishing, or physical trespassing
- Exfiltrating, viewing, altering, or destroying user data
- Executing destructive automated scans or fuzzing production APIs
How to Report a Security Vulnerability
Email full vulnerability details and PoC to contact@qimlab.com.my with subject [Security Report].
Our engineering security team will acknowledge receipt of your vulnerability report within 48 business hours.
We prioritize and release patches promptly (Critical within 72 hours; High within 7 business days) with researcher credit.
Computer Security Incident Response Protocol (CSIRP)
In the unlikely event of a verified data breach, unauthorized access, or system compromise, Qim Lab Enterprise activates its dedicated CSIRP:
- Containment & Isolation: Immediate network isolation of affected compute clusters to stop lateral movement.
- Eradication & Forensic Analysis: Root cause analysis (RCA), artifact preservation, and vulnerability elimination.
- Statutory & Client Notification: Affected subscribers, clients, and Malaysian regulatory bodies (including the Personal Data Protection Department - JPDP) will be notified without undue delay, and in all circumstances within 72 hours of confirmation.
- Post-Incident Remediation: Implementation of architectural enhancements and publication of an incident post-mortem to prevent recurrence.