All browser connections and communication are encrypted and transmitted over TLS (formerly known as SSL). Our servers only support 128- or 256-bit cipher suites over TLS 1.1 or higher, protecting against unauthorised disclosure, modification, and replay attacks.
Our policy is to only select cloud partners that encrypt all physical media on which customer data resides, including database and backups. In the unlikely event of a physical breach of underlying infrastructure (i.e., if someone broke into the data centre and removed the disk drives), your data would be protected.
Our production environment undergoes penetration testing bi-annually, using industry standard tools to replicate hacking attacks.
We use a number of tools to proactively identify known security vulnerabilities. Our policy is to resolve critical vulnerabilities within 72 hours.
HandsHQ products are designed with security that aims to meet OWASP standards for web applications.
At least annually, engineers participate in web application security training covering OWASP Top 10 Application Security Risks.