1. What this note covers
This note describes security controls that are implemented in the live product. It is not ISO 27001 certification, a penetration-test report, or a claim that the platform is enterprise-grade.
2. Access
- Sign-in uses a hashed password and an HTTP-only session cookie named hseqconsulthub_token.
- Browser mutations require a same-origin check.
- Workspaces are tenant-scoped. A consultancy user sees only the clients their membership allows.
- Privileged owner actions can require a fresh password. MFA is used where the Founder has enabled it.
- Report-only access uses a PIN, QR token or email sign-in and does not open the full dashboard.
3. Files and secrets
- Durable files go through the platform storage adapter. Business modules must not write their own cloud disks.
- Reusable storage URLs, PINs, QR tokens and session material are not included in Organisation Migration or Subject Access downloads.
4. Incidents
Where HSEQ ConsultHub Ltd becomes aware of a personal data breach affecting data processed on behalf of a consultancy firm, the Data Processing Agreement requires notice to that firm without undue delay and within 48 hours where information is available. The consultancy firm decides whether to notify a regulator or affected people unless HSEQ ConsultHub Ltd has its own legal duty.
Day-to-day access problems should be raised through the contact form or the signed-in support path.
5. Changes to this document
HSEQ ConsultHub may update this Security note from time to time to reflect platform changes, legal requirements, security improvements or commercial developments. The date at the top of the published page is the current version. Continued use of the platform after that date is acceptance of the updated document, except where a signed written agreement with HSEQ ConsultHub Ltd says otherwise.
6. Governing law
This Security note is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with it, except that HSEQ ConsultHub Ltd may seek injunctive or other relief in any court of competent jurisdiction to protect its intellectual property, confidential information or platform security.