Clear about what is protected, and what is still yours to do.
Health and safety records are sensitive. This page lists what the platform enforces, what you configure, and which certifications we do not claim.
- Built in
- You configure
- Not yet
What protects your records
Each item is tested in the project’s automated suite or marked as your responsibility.
- Built in
Organization isolation in the database
Every query runs as a restricted database role with the organization taken from your signed-in session. Row-level security keeps one organization from reading another’s records.
- Built in
Role-based access from your membership
Access comes from your verified membership and role. Browser settings and AI responses cannot grant permissions.
- Built in
Signed, revocable certificates
Fitness certificates are signed. Tampering, expiry and revocation are detected when someone verifies a certificate by QR code, and the public page shows only the fields needed to confirm it.
- Built in
Secrets stay on the server
Database connection strings and provider keys are encrypted at rest by the application and never returned to the browser.
- Built in
AI drafts, people decide
AI output is validated structured data. It never runs SQL, changes roles, grants clinical permissions or certifies compliance, and clinical results need an authorized reviewer.
- You configure
Encryption in transit and hosting controls
Production TLS, backups, storage scanning and key management depend on the hosting you deploy to. Setup checks guide you, but they are not a substitute for your own review.
Your data, your choices
Your database
Bring separate development and production databases that your company owns, for example on Supabase or your own PostgreSQL.
Your region
Pick the hosting region during setup. Residency rules for your country narrow the list of regions offered.
Your administrator
A verified organization administrator confirms the setup and decides who joins and with which role.
Compliance status
Regulations apply to your organization’s activities. The platform helps; it does not certify you.
| Framework | Status | What it means |
|---|---|---|
| HIPAA / PHIPA | You configure | Tools to separate and audit health data. Your agreements, BAAs and provider plan decide compliance. |
| GDPR / PIPEDA | You configure | You choose the database region. Review processing locations for files, workflows and AI separately. |
| OSHA 1904 / provincial OHS | You configure | Recordkeeping forms and workflows are provided. Legal applicability must be confirmed for your jurisdiction. |
| SOC 2 | Not yet | No SOC 2 report has been issued. |
| ISO 27001 / 45001 | Not yet | Not certified. We do not display certification marks. |
Common questions
Is HSE Platform HIPAA or GDPR certified?
No product is certified by using it. HIPAA and GDPR have no certificate. We provide controls and clear records, and your organization remains responsible for agreements, access and retention.
Where is our data stored?
In the database you connect, in the region you select. Attachments use your verified storage when connected. AI, email and workflow providers process data where you configure them.
Can AI change what a clinician decides?
No. AI proposes drafts. A signed-in reviewer with the right role accepts, edits or rejects them before they become part of a record.
How do I report a vulnerability?
Email security@hseplatform.com with steps to reproduce. Please do not include real patient data.