Security and data handling
What we do to keep your workplace records safe, stated plainly — with what we don’t claim.
Your records stay in your business
Every request to the database is checked against the signed-in person’s business, location and role, in the database itself — not only in the app. Our automated tests try to read and change another business’s data as owners, managers, staff and signed-out visitors, and must be refused.
Records can’t be quietly changed
Submitted records are kept as they were recorded. Corrections are stored beside the original with who, when and why.
Support access only with the owner’s permission
Hygivo Support can’t see a business unless its owner allows a specific request in the app: read-only, for a short time, limited to the locations and information requested, clearly labelled and ended whenever the owner chooses. Every request, view and refusal is logged and visible to the owner. There is no “log in as a customer” feature and we never ask for passwords.
Accounts
Passwords must be at least 8 characters with a letter, a number and a symbol, and are checked when you choose them. Sign in with Apple and Google are supported. Staff access to Hygivo’s own administration requires a second sign-in step.
Where data is kept
Hygivo uses Supabase (database, sign-in and photo storage) in the EU (Ireland region). Label reading for deliveries runs on your phone. Full list of providers: Privacy.
Backups
The database is backed up by our hosting provider. Photos are stored separately and need their own backup; our restore procedure covers both and is tested before we rely on it. Restoring is not instant, and we don’t claim zero data loss.
Report a vulnerability
Email [email protected] with what you found and how to reproduce it. Please don’t access other people’s data or disrupt the service. We’ll acknowledge reports and keep you informed.
We follow the OWASP Mobile Application Security Verification Standard as a checklist. That is not a certification.