1. Our Security Approach
HumanCapital CXO® applies defence-in-depth security across all layers of the HCV Model platform. This statement describes the technical and organisational measures in place as of the effective date above. We update this page when material changes are made.
2. Infrastructure Security
| Layer | Provider | Measures |
|---|---|---|
| Network edge | Cloudflare | DDoS mitigation, WAF (Web Application Firewall), bot management, TLS 1.3 everywhere, HSTS enforced, no HTTP allowed |
| Access control | Cloudflare Workers | Every request to /* validated against a Supabase JWT before the origin server is reached. Invalid or expired tokens are rejected at the edge — the origin never sees unauthenticated requests. |
| Database | Supabase (PostgreSQL) | AES-256 encryption at rest; Row Level Security (RLS) — every user can only read/write their own rows; no direct database internet exposure |
| Authentication | Supabase Auth | bcrypt-hashed passwords; short-lived JWT session tokens; secure HttpOnly cookies; PKCE where applicable |
| Origin hosting | Cloudflare Pages / static hosting | No server-side code at origin for static HTML pages; attack surface minimised |
3. Data Protection Measures
- Encryption in transit: TLS 1.3 on all connections. Cloudflare enforces HTTPS; HTTP is redirected.
- Encryption at rest: AES-256 on all Supabase database tables and file storage.
- Pseudonymisation: HCV calculation data references internal IDs, not names, within the calculation engine.
- Secrets management: API keys and secrets stored as Cloudflare environment variables — never committed to source code or exposed client-side.
- Least-privilege access: Supabase Row Level Security ensures users can only access their own data. Service-role keys used only in server-side Worker code.
4. Access Controls
- Two-factor authentication available for all accounts (recommended for Enterprise and API users).
- Session tokens expire after 1 hour; refresh tokens expire after 7 days of inactivity.
- All authentication events (login, logout, failed attempts) are logged with truncated IP and timestamp.
- Admin access to the Supabase dashboard requires MFA and is restricted to authorised personnel only.
- Cloudflare dashboard access requires MFA.
5. Monitoring and Incident Response
- Cloudflare provides real-time DDoS and anomaly alerting.
- Supabase audit logs capture database-level access events.
- Personal data breaches: assessed within 24 hours of discovery; Swiss FDPIC notified within 72 hours where required (GDPR Art. 33 / nDSG Art. 24); affected users notified without undue delay where required (GDPR Art. 34 / nDSG Art. 24(4)).
- EU AI Act Art. 26(5): Where the platform is deployed as a high-risk AI system, any incidents with a serious risk or actual harm must be reported to the relevant national market surveillance authority without undue delay. Deployers bear primary responsibility for this obligation in their jurisdiction.
6. Vulnerability Disclosure
If you discover a security vulnerability in the platform, please report it responsibly to security@humancapitalcxo.com. Include a description of the issue, steps to reproduce, and your contact details. We will acknowledge receipt within 48 hours and aim to resolve confirmed vulnerabilities within 90 days. We will not take legal action against good-faith security researchers who follow this process.
Please do not publicly disclose the issue until we have had a reasonable opportunity to address it.
7. Third-Party Security Posture
- Supabase: SOC 2 Type II audited. Security details at supabase.com/security.
- Cloudflare: ISO 27001, SOC 2 Type II, PCI-DSS certified. Details at cloudflare.com/trust-hub.
8. Penetration Testing and Audits
We conduct annual security reviews of authentication flows, access control logic, and data handling. Enterprise customers may request a copy of our most recent security assessment summary under NDA by contacting security@humancapitalcxo.com.
9. Contact
Security enquiries: security@humancapitalcxo.com
General privacy: privacy@humancapitalcxo.com