Security Isn’t Just a Promise — It’s Action

From development to release, every stage is independently verified. QNAP is defining a new security standard for NAS storage, networking, and cloud products, through action.

View Full Certifications Bounty Program

4

International Certifications

in Security & Privacy Standards
9-Hr

High-Severity Vulnerability Investigation Deadline
Champion-Level

Penetration Test Certified by Pwn2Own Champion Team: Viettel Cyber Security
CNA

MITRE-Authorized

CVE Numbering Authority Status

International Certifications & Compliance

From process to product, fully verified by independent third parties

QNAP holds ISO 27001, ISO 27017, and ISO 27018, among other international certifications. From development methodology to cloud data protection, every layer is backed by independent certification bodies.

ISO 27001 (Information Security Management)

QNAP’s internal operations, asset protection, and day-to-day risk controls all comply with the world’s leading information security management framework — safeguarding the confidentiality and integrity of enterprise data throughout every engagement and integration.

Learn More
ISO 27017 (Cloud Security)

A security control standard designed specifically for cloud services. QNAP ensures that data protection for cloud services such as myQNAPcloud One meets international requirements.
ISO 27018 (Cloud Privacy)

QNAP ensures its cloud services enforce strict encryption, access controls, and transparency when processing and storing personally identifiable information (PII). Audited by an independent third party, this certification gives enterprise customers handling global data meaningful contractual and legal assurance, reducing compliance costs for cross-border operations.
GDPR & CCPA (Privacy Regulation Compliance)

QNAP complies with the EU’s GDPR and California’s CCPA privacy regulations, protecting users’ rights to know, access, and delete their personal data. QNAP does not sell user personal data, and provides transparent data-handling disclosures and request channels, ensuring enterprise customers’ compliance needs in European and U.S. markets are fully supported.
HIPAA (Healthcare Data Compliance)

The U.S. Health Insurance Portability and Accountability Act is the key standard by which the healthcare industry protects Protected Health Information (PHI/ePHI). QNAP NAS uses zero-trust login protection, AES-256 encryption at rest, WORM immutable storage, proactive ransomware detection, and comprehensive access audit logs to help healthcare organizations bring ePHI securely into HIPAA compliance strategies, ensuring the confidentiality, integrity, and availability of patient records, and providing a solid technical foundation for compliance for healthcare, biotech, and multinational customers.

Learn More
JC-STAR Level 1 (Japan’s IoT Security Certification Mark)

Established by Japan’s Information-technology Promotion Agency (IPA), this security tiering certification system was created specifically for Internet of Things (IoT) products. QNAP NAS has passed Level 1 certification, demonstrating that its products meet common baseline security requirements. This allows enterprise IT departments, resellers, and system integrators (SI), as well as government agencies and educational and healthcare institutions, to instantly confirm the security level of storage equipment when purchasing — making it easy to confidently include on procurement lists.

Learn More

PSIRT (Product Security Incident Response Team)

Critical-Severity Vulnerabilities Resolved Within 3 Days

QNAP PSIRT operates through a standardized process, coordinating cross-functional teams — from intake and impact assessment to remediation and disclosure — ensuring every security vulnerability is handled quickly and affected users are notified.

View Security Advisories

QNAP PSIRT Product Security Incident Response Team

9-Hr
Vulnerability Investigation Completed

Within 9 hours of receiving a high-severity report, initial assessment and impact scope confirmation are completed.
14-Hr
Vulnerability Fix Completed

Within 14 hours of confirming a vulnerability, a fix is produced; Critical-severity fixes are released within 1 week.
24-Hr
Full Incident Resolution

From initial report to full incident response, the entire process is completed within 24 hours.

Proactive Testing Ecosystem

We invite the strongest attackers to challenge our products

QNAP actively takes part in international security competitions, engages top red teams, and partners with government agencies, putting our products through the toughest tests before they ever reach the market.

Pwn2Own International Competition (2024–2025)

The world’s most demanding vulnerability discovery competition. QNAP has competed for multiple consecutive years, facing live attack challenges from the world’s top hackers in public, and completing all fixes swiftly after each event.
Viettel Cyber Security Certification (2026)

QNAP commissioned VCS, a multi-time Pwn2Own champion team, to conduct comprehensive penetration testing on QuTS hero. Every identified vulnerability was fully remediated and verified prior to certification.

Learn More
NICS Product Security Bug Hunting Program (2025–2026)

Guided by Taiwan’s Administration for Cyber Security under the Ministry of Digital Affairs and hosted by the National Institute of Cyber Security, QNAP served as a flagship blue team representative, working with leading domestic white-hat hackers to test the ADRA NDR and QHora product series.
ZDI Zero Day Initiative Sponsorship (2024)

By sponsoring Trend Micro’s Zero Day Initiative lab, QNAP takes part directly in the world’s largest zero-day vulnerability research community — helping accelerate security improvements across the entire industry.
Matrix Cup, Qingdao (2024)

One of the largest live attack-and-defense competitions in China, similar in nature to Pwn2Own. QNAP’s team was invited to compete, facing real-time challenges from top white-hat hackers worldwide in intense on-site rounds, and completed vulnerability fixes and verification swiftly after the event.
Bounty Program (Ongoing)

QNAP continuously collaborates with security researchers worldwide, using a rewards program to encourage proactive reporting. All Critical-severity vulnerabilities are fixed within 3 days, with reporters notified promptly.

Learn More

Supply Chain Security

Security Starts With the First Line of Code

QNAP has implemented SBOM tracking and open-source compliance policies, and integrated AI-assisted code review and vulnerability scanning into the CI/CD pipeline across its entire product line.
From open-source packages to AI-generated code, every component is under control, spanning the full NAS storage, networking, and cloud product line.

Software Bill of Materials (SBOM)

A complete inventory of every open-source package, version, and license used in QNAP software. An automated tracking mechanism periodically scans and cross-references the latest vulnerability intelligence — instantly triggering remediation and verification whenever a high-risk vulnerability is found — strengthening software supply chain security and risk management overall.

Learn More
AI-Assisted Code Review

AI technology enhances code review efficiency, automatically detecting potential security issues.
AI Risk Management

A dedicated SOP for GenAI-generated code manages the emerging risks introduced by AI-generated code.
DevSecOps & CI/CD Integration

Automated security checks are embedded directly into the development workflow — every code commit triggers a security scan — catching vulnerabilities before they reach the product, rather than patching them after release.

More Resources

From real-time security advisories to secure storage solutions, explore further how QNAP protects your data.

Subscribe to Security Advisories

Be the first to know about the latest security advisories and vulnerability fixes.

Subscribe Now
QNAP Secure Storage Solutions

Learn how QNAP builds a secure NAS storage environment with multi-layered protection.

View Solutions
Bounty Program

Join the global community of security researchers to help strengthen product security.

Join the Program