Security
Payroll, clients, receipts and school-run records are sensitive. This page says what protects them today, what we watch, and what we are still adding. We would rather tell you what is not done than imply it is.
Build
Every commit is scanned for passwords, keys and tokens before it is saved. Live keys are kept in a managed secrets store, and each function can read only the one it needs.
Dependencies, known vulnerabilities, code rules and licences are checked and reported before code leaves a developer's machine. The gate follows SecureDX, the graduated security-gate approach developed in-house by HERO CONTROL SYSTEMS.
Security lint rules reject dangerous patterns such as dynamic code execution, and commit rules keep every change labelled and traceable.
Automated tests check that one company's records are fenced off from another's on the features that hold the most sensitive data.
Tools are pinned to exact versions, installs come from a locked list, and a release will not build if its environment settings are missing or the deployment would grow past a set size.
Debug output is removed from the live app, so nothing internal appears in a browser console. Errors that matter are shown to the person in the app instead.
Platform
Every person signs in with a verified email and a strong password: at least eight characters with upper and lower case, a number and a symbol.
Each company's data is reachable only by signed-in people who belong to that company. The check happens on the server, not just on the screen.
Staff access to the back office is a separate group. Every action is written to an audit log, support views are read-only and logged, and an account can be disabled and signed out everywhere.
Payslips, quotations, invoices, receipts and delivery notes carry a code. The public check page shows the figures only when the code matches, so an altered document fails.
The database and file storage are encrypted at rest, and the app is served over HTTPS.
The production database keeps point-in-time recovery, so it can be restored to any moment in the last 35 days, and its tables are protected against accidental deletion.
A health check runs every hour. Critical problems are recorded and emailed to us, and incidents can be investigated by an AWS DevOps Agent.
Each layer here is something we can point to in our code or our live system. Protections that are not in place yet are listed below under what we are adding.
Also in place
What we are adding
These are the next protections on our list. We will move each one up the page when it is live.
A second step at login for administrators and anyone who asks for it.
Filtering and rate limits in front of the public pages.
Scheduled attack-style scans of the running application, alongside our code scanning.
A third party tries to break in and we publish what they find and what we fixed. No independent test has been done yet, so we do not claim one.
Questions
Yes. Each company's records can be reached only by signed-in people who belong to that company, and the API enforces it on the server. We also run automated tests that check the separation on our most sensitive features.
In Amazon Web Services, region us-west-2 (Oregon, USA). The database and file storage are encrypted at rest and the app is served over HTTPS.
The production database keeps point-in-time recovery, so it can be restored to any moment in the last 35 days, and its tables are protected against accidental deletion.
Not yet. It is the first item on our list of protections we are adding next, along with a web application firewall, live-site scanning and an independent penetration test.
Not an independent one. We have not yet had a third-party penetration test, and we do not claim one. We will publish the result and what we fixed once it is done.
A health check runs every hour. Critical problems are recorded and emailed to us, every back-office action is written to an audit log, and incidents can be investigated by an AWS DevOps Agent.
Your own signed-in staff. O'Sense support can view a company only in a read-only view, and each such view is written to an audit log. Support cannot sign in as you.
Email admin@hcsys.co or message us on WhatsApp on +260 974 546 632. Please describe what you found and how to reproduce it, and do not access other people's data to prove it.
Email admin@hcsys.co or message us on WhatsApp. We will answer a customer security questionnaire in writing.