HSE and quality records often contain sensitive information about people, incidents, customers and suppliers. This overview describes the protections built into the HSE, Quality and QHSE Command Centers today (one application, the same protections). It is not a certification.
1. Sign-in and accounts
- Every user has their own account and chooses their own password; we never email passwords.
- Users sign in with their username or email address. Passwords are stored only as salted PBKDF2-HMAC-SHA-256 hashes with 600,000 iterations.
- Multi-factor authentication is mandatory for administrators, set up by scanning a QR code with an authenticator app such as Google or Microsoft Authenticator, with one-time recovery codes.
- Repeated failed sign-ins trigger a temporary lockout, and sign-in attempts are logged.
- Invitation and activation links are single-use, expire, and are stored only as hashes.
2. Separation between organizations
- Each organization has its own Workspace, users, roles and records.
- Every request is checked against the signed-in user’s organization. Before launch, an isolation audit tested every API route in both directions between organizations and found no cross-organization access.
3. Permissions and governance
- Role-based permissions inside each Workspace; the last administrator cannot be removed or disabled.
- Monthly KPI figures move through Draft → Submitted → Approved → Locked.
- Governed reports are fingerprinted, reviewed and approved by different people, and can be exported only once locked.
- Security, administrative and governance events are written to an audit trail.
4. Data protection
- All traffic is encrypted (TLS) with HTTP Strict Transport Security; a strict Content-Security-Policy limits what the browser may load.
- Session cookies are HttpOnly, Secure and SameSite=Strict, with CSRF protection.
- Data is hosted on Cloudflare, which encrypts stored data at rest. Uploaded files are kept in private storage with no public link and are limited to documents and images up to 5 MB.
- Point-in-time database recovery is available for up to 30 days, and restore drills have been completed successfully.
5. Public QR reporting
QR-code observation reports are accepted without sign-in but go only to the organization that owns the QR code, enter its records only when an authorized user accepts them, are rate-limited, and record only a one-way (hashed) form of the reporter’s IP address.
6. Payments
Card details are entered on Stripe’s checkout and billing pages and never reach our systems. Online purchases are protected against automated abuse with Cloudflare Turnstile.
7. Operations
- Internal operator tools sit behind access control and require multi-factor authentication.
- Changes are tested and rehearsed before release, with a database backup and a documented rollback for every production release.
8. Report a security issue
Email [email protected]. Please give us a reasonable chance to fix an issue before disclosing it publicly.