How we protect your work
Your drafts, files, approvals and invoices live in a private client portal built with security as the default. Here's what that means in practice.
Only the right people get in
Two-step sign-in for everyone
Every account, including ours, needs a password and a code from an authenticator app at every sign-in. It can't be switched off.
Invitation-only accounts
There's no public sign-up. Accounts are created from a single-use invitation that expires, and each person sees only the projects they've been added to.
Strong, never-stored passwords
Passwords must be at least 15 characters, are checked against known data breaches, and are stored only as a one-way hash.
Sessions that expire
Idle sessions end automatically and every session ends within 8 hours. You can see and end your sessions from the Security center.
Brute-force protection
Repeated wrong passwords pause sign-in, and repeated wrong codes lock the account for 15 minutes.
Proof you can check yourself
Accountability shouldn't depend on taking our word for it.
Tamper-evident activity log
Sign-ins, downloads, approvals and payments are recorded in a log where each entry is sealed to the one before it with a keyed hash. Editing, removing or inserting an entry breaks the chain, and we can check it at any time.
Approvals tied to exact versions
When you approve a draft, we record the file's SHA-256 fingerprint and your typed signature. Your approval certificate proves which version you approved.
Verifiable documents
Every invoice, receipt, quote and certificate carries a unique code and QR code. Anyone can confirm it's genuine and see its current status on our Verify page.
Files checked by their contents
Uploads are checked by what's inside them, not just their name, and are only downloadable through links that re-check your access every time.
Card payments on Stripe
Invoices are paid on Stripe's hosted checkout. We never see or store your card number.
Privacy-first analytics
We count website visits without cookies and without storing IP addresses, and we honor Do Not Track and Global Privacy Control.
Received a document from us?
Check its verification code or confirm a file is exactly what we delivered, without signing in.
Behind the scenes
- The website and portal are served only over HTTPS, with HTTP Strict Transport Security.
- A strict Content Security Policy, set fresh on every request, limits what can run on our pages and blocks common attacks such as cross-site scripting and clickjacking.
- Every page and download re-checks who you are and what you're allowed to see on the server, so removing someone's access takes effect immediately.
- Forms are protected against automated abuse with rate limits.
- Data is backed up automatically every day, with two weeks of backups kept.
- Software dependencies are checked for known vulnerabilities when the site is updated.
What we don't claim
No website or system is perfectly secure, and we won't pretend otherwise. We don't hold security certifications, and this page describes the protections we've built rather than a guarantee. If something does go wrong, we'll tell affected clients as the law requires and work to fix it quickly.
Report a security issue
If you believe you've found a security problem with this website or the client portal, please email support@havardsolutions.com with “Security report” in the subject. Include what you found and how to reproduce it. Please don't access other people's data, disrupt the service, or share the issue publicly before we've had a chance to fix it. We appreciate responsible reports.
Machine-readable contact details are published at /.well-known/security.txt.
Questions about security?
We're happy to walk you through how your project's files and records are protected.