01 / IT & Security

Managed IT & MSPSupport, cloud, infrastructure and migrations CybersecurityUnderstand, address and monitor your risks Monitoring & ISO preparationVisibility, evidence and documentation

02 / AI & Software

AI & automationAgents and connected business workflows Software & websitesBuild the systems your business needs Find your starting pointA few questions. A clearer brief.

03 / Global Teams

Specialist peopleIT, finance, marketing, HR and assistance Explore your savingsA simple percentage-based comparison Start with a free assessmentUnderstand your environment and next steps

Meet QNN

Our story & visionEnterprise-grade IT, with people you can reachOur leadershipMeet the people who own the workOur group companiesPrime Edge, Astrobot Academy, Hassan & Sons

Working together

Your first 90 daysA clear plan for taking over and improvingService levelsCoverage, priorities and escalationIndustriesSupport shaped around your sector

Good questions, clear answers

Trust & securityHow access, data and responsibilities are handledFrequently asked questionsScope, savings and working with QNNContact usPakistan, Oman and the United States

QNN SolutionsTrust pack

The answers to
your security review.

Most of what a procurement team asks a supplier is the same every time. Rather than make you send the questionnaire first, here are our answers.

Request the full pack
Published, not on requestRight to audit acceptedSubprocessor list available

Supplier due diligence

Six things procurement
always asks.

If your questionnaire has a question this does not answer, send it over — we complete them properly and we do not claim controls we cannot evidence.

Access control

How we do it
  • Named accounts for named people. No shared logins.
  • MFA on every account that touches a client system.
  • Least privilege, scoped to the agreed work and reviewed during the engagement.
  • Access removed at the end of the engagement, confirmed in writing.

Our own devices

How we do it
  • Encrypted, patched and centrally managed.
  • Screen lock, disk encryption and endpoint protection enforced.
  • No client data stored on local machines outside sanctioned tooling.

Data handling

How we do it
  • Delivery teams are in Pakistan; data may be accessed from there and from other group locations.
  • Where residency is required, processing and monitoring data stay in the cloud region you specify.
  • US clients are told plainly that delivery teams in Pakistan may access the data, under the protections in your agreement.
  • Retention periods are set in your agreement, not by us unilaterally.

Subprocessors

How we do it
  • Microsoft 365 for mail and productivity.
  • The cloud platform your work runs on — Azure or AWS, under your tenancy where possible.
  • Monitoring tooling — Zabbix and Wazuh, self-hosted rather than a third-party SaaS.
  • A full list with locations and purposes is provided on request and kept current in your agreement.

Incident response

How we do it
  • We tell you as soon as we know, not once we have the full picture.
  • Containment steps agreed with you on the same call.
  • Written post-incident report: what happened, what was affected, what changes.
  • Statutory notifications made within the required window where personal data is involved.

Governance and audit

How we do it
  • Right to audit is accepted in engagement agreements where you need it.
  • We complete client security questionnaires and provide evidence for what we claim.
  • ISO 27001 internal audit preparation is something we run for clients — see the monitoring page.
  • Certifications held by group companies are named with scope and issuing body on request.

What we will not claim

Certifications we
do not hold yet.

Plenty of suppliers imply an ISO certification they are "working towards". We would rather tell you where we actually are.

  • We prepare clients for ISO 27001

    Gap assessment, policy and evidence set, internal audit and management review inputs — as a paid consulting engagement. That is different from holding the certificate ourselves.

  • Certifications held by group companies

    Named individually, with scope and issuing body, on request. We will not put a badge on a website that we cannot produce a certificate for.

  • Insurance

    Professional indemnity and cyber liability details are provided during contracting. Ask for them early if your procurement process needs them.

  • References

    Named client references are available with their permission, matched to your sector where we can.

Need this in your format?

Send us your supplier questionnaire and we will complete it properly, including the questions where the honest answer is no.

  • 1
    We aim to reply within one working dayA person, not an autoresponder.
  • 2
    A 20-minute scoping callEnough to tell you whether we are the right fit.
  • 3
    A written scope and priceWith the exclusions stated, before anything starts.
No obligationNo lock-in contractsWe never ask for credentials

Or write to info@qnnsolutions.com

What is this about?
Helps us come back with something specific.

We use your details to respond to this enquiry. Privacy policy.