Quinyx

We're pleased to announce that Quinyx has successfully completed its ISO 27001 recertification, reaffirming our compliance with the internationally recognised standard for information security management. This recertification demonstrates our sustained commitment to maintaining the highest standards of information security — not just as a one-time achievement, but as an ongoing practice embedded across our organisation. You can find our latest ISO Certificate in the Resources tab of our Trust Center.

Quinyx was made aware of the React2Shell (CVE-2025-55182) vulnerability as part of our threat intelligence and the notification from CERT-SE at 2025-12-04 09:30 and have assessed our posture in relation to this. Although Quinyx uses React and Next.js, after reviewing our codebase and dependencies, we confirm that Quinyx does not use any of the affected versions or packages. Therefore, our systems are not within the scope of the vulnerability We continue to monitor the situation for any additional indications of additional packages or versions being noted as affected and continue to monitor the situation as a whole.

Quinyx have recently upgraded from ISO 27001:2013 to ISO 27001:2022 and have therefore updated the publicly available certificate as well as the latest version of our Statement of Applicability which is available on request from the Trust Center.

If Quinyx provides custom reports to you, we will start using Babelway© by Tradeshift for providing the custom reports. Babelway© by Tradeshift is a SaaS Integration middleware and is used for building and hosting integration workflows. Quinyx is committed to keeping your sensitive and personal data safe. We want to make you feel confident about how your personal data is being collected and used by Quinyx. Therefore, we would like to inform you that Tradeshift Belgium SA, 6, Chemin du Cyclotron, B-1348 Louvain-la-Neuve, Belgium will be added as a sub-processor under the Data Processing Agreement. For clarity, the addition of this new sub-processor does not entail a transfer of your personal data to any third countries without adequate level of protection. No further action is required on your part. If you have any questions or feedback - write to us via [dataprivacy@quinyx.com](mailto:dataprivacy@quinyx.com).

We are currently developing a training environment together with a partner of ours. In this environment, videos and other generic training material regarding our service will be made accessible for a limited number of select users. In order to access and use this environment that is separate from your Quinyx environment, processing of certain basic account information (contact information, title, department, region, and whether training has been completed or not, etc.) constituting personal data will be required. For this purpose, Attensi AS, Forskningsparken, Gaustadalléen 21, 0349 Oslo, Norway will be added as a sub-processor under the data processing agreement forming part of your agreement with Quinyx, effective from 1 October 2024. We also want to inform you that Intercom R&D Unlimited company is no longer used as a sub-processor under your data processing agreement (if applicable). For clarity, other than as set out above, no changes are made to the data processing agreement, and no further action is required on your part. If you have any questions or feedback, write to us via [dataprivacy@quinyx.com](mailto:dataprivacy@quinyx.com).