BlastIQ Security and Privacy overview

Orica is committed to ensuring the security and privacy of our customer's data stored in the BlastIQ system. This is an overview of our approach to security and privacy. However, we would be happy to provide additional information on request.

Privacy Policy

BlastIQ operates in compliance with the Orica privacy policy, available here:

Information Security Management System

Orica Digital Solutions – Blast Design & Execution (BD&E) is ISO 27001 Certified


Security Testing

BlastIQ undergoes independent 3rd party security testing at least annually (and additionally on-demand as required) in line with company procedures. Testing includes penetration testing (unauthorised access) and internal data segregation security (testing for authorised access beyond privileges).

Critical and High severity vulnerabilities are remediated with the highest level of urgency by the BlastIQ engineering team. Security Audit Reports are not provided to customers for security reasons.

Security Breach Notification

As required by law, Orica will notify customers and users in a timely manner of a Notifiable Data Breach. In addition, Orica will notify customers in a timely manner if any of their data in BlastIQ is the subject of a Data Breach.

Data Storage and Processing Location

Data stored in BlastIQ is primarily located in Azure centres in Singapore. For data security information relating to infrastructure platforms, please refer to

Data Backup

Automatic backups are taken on a minimum of a daily basis for all datastores, critical transactional systems have much shorter backup windows. 

System Availability

BlastIQ Systems are hosted as distributed cloud services with zero downtime upgrades for most deployments. Historical availability and planned Maintenance or Incidents impacting availability of the BlastIQ system components are published at, and customers can subscribe to receive notifications of planned maintenance outages and incidents affecting availability.

Change Management

BlastIQ is offered as a multi-tenanted Software as a Service offering. Customers are not consulted for approval of changes, however, Public APIs are versioned for breaking changes and customers have time of concurrent versions operating to facilitate upgrades.

Public notifications of application updates can be subscribed to via with release notes published for end-user applications on the BlastIQ Support Centre

The BlastIQ system changes are all tested in Development and Test environments prior to release, these environments contain mock data for security reasons (A Customer’s data will not be removed from the Production Environment).

All code changes are peer-reviewed, then tested in development and test environments using automated test suites and manual testing prior to release to the production environment.

Secure Application Development

The BlastIQ Engineering team practices secure application development in accordance with a documented Secure Application Development standard.

All code changes are peer-reviewed and merged using source control systems with audit records and history of changes.

All application builds and deployments to cloud infrastructure or release for download are performed using automated continuous integration systems to ensure reliability, repeatability, and security.

Data Ownership

Please refer to your BlastIQ Commercial Agreement for Data Ownership contract terms.

Data Portability

Data stored in the BlastIQ System can be extracted by the customer using the BlastIQ Public API, documented here:

Data Access

Users with access to a customer's data are categorised into Read, Write and Admin roles and are visible within the BlastIQ Administration portal at 

A limited number of BlastIQ team members have access to customer data for support and maintenance purposes. These team members operate within strict guidelines to ensure customer data is managed securely and privately at all times.


All BlastIQ data is encrypted in transit using Transport Layer Security (TLS). Data stored in the BlastIQ Platform is encrypted at rest.

Single Sign-On

Single Sign-On to BlastIQ is used for all Orica employees (including mandatory multi-factor authentication). 

Single Sign-On is available to customers with an Azure Active Directory for their domain (e.g., please raise a support request if you would like to set this up for your domain users.

Logging and Auditing

All activities on BlastIQ, particularly those relating to security are logged. BlastIQ is a multi-tenanted application and these logs are not available to customers at this time.

Domain Whitelist

BlastIQ relies on connectivity from the customer's devices to a number of internet domains to provide the services, they are detailed here:

Minimum System Specifications

The minimum system requirements to run BlastIQ are documented here:

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request