Enterprise

Enterprise QEHS, without the enterprise rollout pain.

Built for CISOs, Heads of EHS, and Operations leaders rolling QEHS across thousands of seats, dozens of sites, and multiple jurisdictions. SSO, SCIM, residency, audit, and a CSM on every deal. Composer-driven configuration replaces six-month custom-build programs.

Compliance posture

Pre-completed assessments + signed agreements move procurement forward faster. Request the full packet from the Trust Center.

Enterprise FAQ

Does QEHS Ethos support SSO and SCIM user provisioning?+

Yes. Single sign-on works over SAML and OIDC with Okta, Microsoft Entra ID, Google, Auth0, Ping, and JumpCloud — these are production-tested recipes, not placeholders. SCIM 2.0 handles automated provisioning and deprovisioning, with group-mapped roles and module-scoped RBAC so permissions can narrow to a specific module, location, or record set. Step-up MFA (TOTP or WebAuthn) guards high-risk transitions like approvals and settings changes.

Where is customer data hosted, and can I pin it to a region?+

The US (us-east-1) region is generally available today. EU, UK, Australia, Canada, and UAE regions are planned and provisioned on enterprise engagement — i.e. on customer demand, not yet self-serve. Once a region is set, per-tenant pinning keeps your content, backups, and search indices in-region. The regulatory-fit matrix covers GDPR, UK GDPR, CPRA, PIPEDA, the Australian Privacy Act, and UAE DPL; field-level encryption with BYOK (AWS KMS or HashiCorp Vault) is available on request.

Can QEHS migrate data from our current EHS tool?+

Yes. Implementation runs in phases — discovery, Composer design, pilot, multi-site, then go-live. Data migration from an incumbent EHS tool uses CSV and API recipes for common export formats, alongside an integration workstream for SAP, Salesforce, ServiceNow, your IdP, SIEM, and data warehouse. A typical timeline is 6–12 weeks for roughly 1,000 seats across five sites. Change-management collateral (train-the-trainer decks, end-user quickstarts, role playbooks) is included.

What SLA and support does the Enterprise plan include?+

An enterprise uptime SLA is negotiated per agreement, with service credits documented in the MSA. Critical-response SLA runs through the founder and an on-call rotation today, with 24×7 SLA paths opening up as the support team is staffed. The founder is your point of contact at launch; a dedicated CSM rotates in as the team scales. A public status page and incident RSS are on the roadmap — until then, incidents are notified directly to enterprise customers.

Does QEHS provide an audit log and a SIEM feed?+

Yes. A tenant-level immutable audit log captures every create, update, delete, access, and permission change. The SIEM feed ships via CEF or JSON to Splunk, Datadog, Chronicle, or Sentinel. Retention policies are configurable per module and record type with legal-hold overrides, and tamper-evident e-sign uses W3C Verifiable Credential signatures on approvals with SHA-256 record hashes.

What compliance certifications and assessments are in place?+

SOC 2 Type II audit is in progress, with security policies published at /docs/security/policies/. ISO 27001 ISMS documentation is in progress and certification follows SOC 2. HECVAT, CAIQ, and SIG Lite vendor assessments are custom-completed on enterprise engagement, and a third-party penetration test is scheduled — an executive summary is available under NDA once delivered. HIPAA is not currently in scope; contact us if your use case requires it.