Tenant isolation
Organization-scoped data access with membership verification on server-side operations.
Security & trust
Main Hub is being built with tenant isolation, server-side authorization, and data minimization as foundational requirements. This page summarizes engineering guardrails—not certifications or audited control reports.
Authorization
Deny-by-default permissions for protected actions, including exports, approvals, and administrative settings.
Sensitive data handling
Engineering practices aim to avoid logging payroll, tax, banking, or unnecessary employee personal information.
Input validation
Untrusted input is validated at API and form boundaries using explicit schemas.
Secrets management
Credentials remain server-side and are not exposed through public environment variables.
Procurement security questions
Security questionnaires and detailed control evidence can be discussed during enterprise evaluation.
SOC 2, ISO 27001, HIPAA, GDPR compliance status, encryption specifications, hosting providers, penetration tests, and uptime guarantees are not claimed on this site without approved evidence.
Vulnerability disclosurePrivacy
See how personal data is handled in our privacy policy once legal review is complete.
Request security materials during evaluation
Book a demo to discuss HCMP, Procurement, or both—and get a tailored view of capabilities and implementation considerations.