CQR offers several services (in the SOA terminology) to its clients. These services may be invoked automatically by client applications and services via service APIs, or manually by end users and administrators via web-based UIs.

Each service is generic and reusable and adheres to the multitenancy principle - i.e., it can handle operations on behalf of several logical clients with complete data isolation. Each is characterized by an explicit contract and is contactable out-of-process. Services can be integrated easily with each other and used in combination.

The following sections contain the relevant technical information about the CQR service offering.

Interfaces and connectivity

All services are contacted by standard HTTPS connections over the Internet.
In case of automated interaction standard SOAP over HTTPS is used. Synchronous client'CQR web service calls are used for invoking service methods. Synchronous CQR'client web service calls are used to notify the client system about specific events which take place in the CQR system.

CQR's web-based interfaces, which employ standard cross-browser HTML, CSS, JS and AJAX, enable secure human-computer interaction with end-users and client administrators.

Security

The services offered are hosted in a PCI-certified production environment characterized with high security standards, including:

• annual external audits, quarterly penetration scans, and automated release scans
• strict change management process
• strict separation of duties
• L3 + L7 firewall security, IDS + IPS

Additionally the following network security is used:

• HTTPS communications
• L3 filtering & source IP address configuration
• L7 screening of request content and filtering of requests

The application-level security measures are:

• Standard WS-Security Username token authentication of web service requests
• Username/password authentication of the admin interfaces (with automatic password expiration, password strength and optional 2-factor authentication
• Custom role/right filter-based authorization system
• Automatic auditing of preconfigured activities (access to sensitive data, changing of configuration, etc.) with optional configurable alerting
• Strong encryption of sensitive data with correspondingly certified key management and regular data re-encryption processes

Availability and scalability

The CQR application design and production environment possess various characteristics enabling high availability and scalability. These include:

• No single point of failure
• Internal network/server redundancy
• Triple database redundancy
• 2 physical datacenters at different locations
• Stateless services, web farms and load balancing for horizontal scale-out
• Asynchronous processing
• Lightweight application framework
• Multiple services and databases (functional decomposition, SOA)
• Real-time automated system monitoring, 24x7
• 24x7 1st and 2nd line technical support & incident reporting

Change and release management

The standard release cycle is comprised of 12 releases, with 1 per month.

All application changes/extensions done are performed in a backward-compatible way. Breaking contract changes are handled as new contracts in separate versions.

All changes to the production environment undergo a strict change management process with automatic security scans (white-box and black-box).