Security
Security & data protection
This page lists the safeguards that are actually in place today, and is open about the ones that are not. We would rather you knew exactly where things stand.
Last reviewed: 27 October 2026
In place today
| Area | What we do |
|---|---|
| Encryption in transit | All websites and applications are served only over HTTPS, using Let's Encrypt certificates. Plain HTTP is redirected to HTTPS, and the applications also send HSTS, which tells browsers to always use HTTPS. |
| Passwords | Passwords are never stored in readable form. They are kept only as Argon2id one-way hashes. Accounts are temporarily locked after repeated failed sign-ins, and temporary passwords must be changed at first sign-in. |
| Sessions | Session cookies are HTTP-only and SameSite-strict. Session tokens are stored only as hashes, and sessions expire after a period of inactivity and after a maximum age. |
| Access control | Owner, Head, Manager and Staff levels, with application access and rights set for each person. Permissions are enforced on our servers, not only in the screens you see. Accounts for people who leave can be switched off immediately. |
| Data separation | In Axon and Attendance, each organisation's records are kept apart by PostgreSQL row-level security, so the database itself enforces the separation. |
| Web protections | Cross-site request forgery checks, request rate limits, security headers including a Content Security Policy, and restricted database accounts that hold only the rights each service needs. |
| Audit trails | Axon tasks are never deleted, and every assignment, review, return and approval is recorded. Attendance corrections keep before-and-after records. Every advertising change in Meta Ads is logged. |
| Backups | Each application's database is backed up nightly and encrypted (AES-256), and each backup is checked after it is written. Backups are kept for 30 days. Axon and Attendance also run an automatic test restore every week. |
| Secrets | API keys and passwords are kept in protected server configuration files, never in the source code or in web pages. |
| This website | The demo form accepts posts only from our own pages, validates every field on the server, and is protected against spam. The website service can store requests but cannot read them back. |
Not yet in place
As we prepare our applications for more customers, we are working on:
- Two-step (multi-factor) sign-in, and sign-in with Google or Microsoft accounts.
- Off-site copies of backups, kept in a second location. Backups are currently stored on the application server.
- Encryption at rest for databases and uploaded files.
- External uptime monitoring and alerting.
- Self-service password reset by email. Today an administrator resets passwords.
We do not currently hold security certifications such as ISO 27001 or SOC 2, and we do not offer a contractual uptime guarantee.
Reporting a security issue
If you believe you have found a security vulnerability, please tell us through the contact form or at info@indigenoushoney.com, and do not access other people's data. We will look into every report.