Hyfo

Draft, pending solicitor review

This document is a draft. It has not yet been reviewed by a solicitor, it is not legal advice, and it may change before anyone is asked to rely on it.

Security summary

Version: 14 October 2026

This is a plain summary of the security measures built into Hyfo, provided by Hyfo. It is limited to what can be checked in the service itself. It is not a certification and it does not promise that nothing will go wrong. The Data Processing Addendum refers to it.

1. Keeping each customer's data apart

  • Every record belongs to one organisation. Each request is tied to the single organisation the signed-in person is an active member of, and the queries behind it are filtered by that organisation's identifier.
  • A person who belongs to more than one organisation works in one at a time, and the choice is checked against their membership on every request.
  • People who have left an organisation have their membership deactivated and lose access to it.

2. Who can do what

  • Access depends on role: owner, administrator, project manager, finance, staff member and subcontractor. Some areas are limited to the owner, such as staff cost rates and the HR Hub.
  • Roles are checked on the server, for pages and for actions, and not only by hiding links.
  • An owner can look at the service as another person (“View as”). That view is look-only, and changes are refused while it is in use.

3. Signing in

  • Sign-in is handled by an authentication provider (see the list of sub-processors), by an e-mailed code or a Microsoft account, and by a Google account where the provider of the service has switched that on. The service does not store sign-in passwords.
  • Customers are asked to remove people who leave and to give each person only the role they need.

4. The HR Hub and the password vault

  • The HR Hub is open to the owner only, and only after the owner enters a separate HR passcode. The passcode is stored as a salted hash. An unlocked session lasts at most four hours, is tied to one person in one organisation, and ends if the passcode is changed. After five wrong attempts the HR Hub locks for 15 minutes.
  • Unlocks, failed attempts, views of staff records, reveals of sensitive fields and downloads of HR files are written to an HR access log.
  • The password vault encrypts passwords, one-time-code secrets and notes with AES-256-GCM before they are stored, and every reveal is logged.

5. Records of who did what

Changes to projects, customers, quotes, invoices, settings and many other records are written to an activity log with who made them and when. The HR access log and the vault access log are separate. How long logs are kept: [to be confirmed before launch].

6. Files

  • Files uploaded to the service are kept in a private store. They are not reachable by a public address. Every download goes through the service, which checks that the person is signed in, belongs to the organisation that owns the file, and is allowed to see that kind of file.
  • Links used to share files with a customer's clients use random tokens that are stored only as a hash, and they expire.
  • HR files can be opened only by the owner with the HR Hub unlocked.

7. Data in transit and at rest

Traffic between your browser and the service is encrypted in transit (HTTPS) by the hosting provider. Encryption at rest is provided by the database and file-storage providers; the service does not add its own encryption to stored data, other than for the vault and for field-app service tokens, which are encrypted with AES-256-GCM. The exact configuration of each provider's encryption: [to be confirmed before launch].

8. Connections to other services

  • Credentials and tokens for connected services are held on the server and are not sent to the browser.
  • Incoming webhooks are checked before they are acted on: by signature for the sign-in provider and for QuickBooks. Scheduled jobs need a secret that only the platform holds.
  • Links sent to subcontractors for registration are signed and expire.

9. Limiting attempts

The HR passcode lock (section 4) is the only attempt limit the service applies itself. The service does not yet apply its own general rate limits to requests. Protection of the sign-in screen is provided by the authentication provider: [to be confirmed before launch].

10. Backups and recovery

  • Database backups are managed by the database provider. Schedule, retention and a tested restore: [to be confirmed before launch].
  • Deleted files can be restored for 30 days. An off-site backup of stored files has been built. Whether it is switched on for this service: [to be confirmed before launch].

11. What has not been done yet

  • Certifications such as ISO 27001, SOC 2 and Cyber Essentials: not yet. None is claimed.
  • An independent penetration test: not yet.
  • An uptime commitment: none is given (see the Terms of Service).
  • Data residency: the application runs in London. Where the database and some other providers process data is in the list of sub-processors, and [to be confirmed before launch] where it does not say.
  • Who at Hyfo can reach production data, and how that access is controlled: [to be confirmed before launch].

12. Report a security issue

If you think you have found a security problem, e-mail hello@hyfo.uk with “Security issue” in the subject. Please tell us what you found and how to reproduce it, do not access or change other people's data, and give us reasonable time to fix it before you tell anyone else. How quickly we reply: [to be confirmed before launch].

13. What customers do

Security is shared. A customer chooses who it invites and their roles, removes people who leave, keeps its own devices and mailboxes secure, and decides which outside services to connect.