HandsHQ is committed to delivering a high-availability platform. We have uptime of 99.6% or higher.
HandsHQ’s servers and databases are hosted in the cloud within the EU. Some data such as database backups and database snapshots are stored in US data centres. We maintain data processing agreements with our cloud partners.
All browser connections and communication are encrypted and transmitted over TLS (formerly known as SSL). Our servers only support 128- or 256-bit cipher suites over TLS 1.1 or higher, protecting against unauthorised disclosure, modification, and replay attacks.
Our policy is to only select cloud partners that encrypt all physical media on which customer data resides, including database and backups. In the unlikely event of a physical breach of underlying infrastructure (i.e., if someone broke into the data centre and removed the disk drives), your data would be protected.
Our production environment undergoes penetration testing bi-annually, using industry standard tools to replicate hacking attacks.
We use a number of tools to proactively identify known security vulnerabilities. Our policy is to resolve critical vulnerabilities within 72 hours.
HandsHQ products are designed with security that aims to meet OWASP standards for web applications.
At least annually, engineers participate in web application security training covering OWASP Top 10 Application Security Risks.
HandsHQ supports Single Sign-On via Okta and Microsoft Entra ID allowing users to access the app securely with their existing SSO credentials.
Two-factor authentication (2FA) provides an additional layer of security, requiring a second verification method during sign in.
Daily database backups are carried out every day. Further, with rollback functionality we can restore a database from any point in time within the past 7 days.
HandsHQ’s disaster recovery procedure is tested every 6 months to ensure the integrity of data and that the engineering team are familiar with the process.
We aim to be transparent about where your data resides with us and how it is handled. We have recently updated our privacy policy and terms of service to explain this in more detail. However, if you would like any further information or to exercise your rights please email our Data Protection Officer.
It is our policy that ex-customer data be deleted within two years of contract termination. Customer data can also be deleted on request.
HandsHQ is certified for ISO 9001 and ISO 27001. Our ISO 9001 and ISO 27001 certificates, policy and statement of applicability (SOA) are available to customers on request.