Skip to content

Security & privacy

We designed it so we cannot read your books.

Your ledger is the most sensitive record your business keeps, and the safest way to protect it is not to collect it. HDHICT holds an account for you: an email address, a business name, and whether you are approved. The programme has to know who it is helping. Your books are a different matter: they stay in your browser, and nothing we store lets us read them.

Where your data lives Your ledger and every calculation stay inside the browser on your device. Your account email, business name and approval status, lives on the server, as does a small amount of usage metadata. Cloud sync is optional; when switched on, an encrypted-in-transit snapshot of your books is stored against your account. Your device Browser storage (IndexedDB) Sales & expenses every transaction Customers names, emails, sales Recipes & costs supplier pricing Invoices issued and paid All the maths runs here Forecast, margins, segments, computed in the page, offline. Your ledger never leaves No amounts, customers or transactions are ever sent. optional only if you switch it on Your account Email, business, approval Sync is optional an encrypted snapshot, over TLS Usage, as metadata only last seen, record count, screens used Never your figures We cannot read your books
The dashed line is the point: your account crosses it, your ledger does not, unless you switch on sync, and then only as an encrypted snapshot we cannot read into.

What we hold, and what we do not.

Stated as two lists rather than a promise, because the distinction is the whole design.

On our server

  • Your email address and a hashed password
  • Your business name and town, from your application
  • Whether your account is approved
  • When you last opened the app, roughly how many records you hold, and which screens you use
  • An encrypted snapshot of your books — only if you switch on sync

Never, under any setting

  • Any amount from your ledger
  • Your customers’ names or contact details
  • Individual transactions, invoices or recipes
  • Your card details — there is nothing to pay
  • Third-party ad pixels or session recording

The usage figures in the first list exist so a volunteer team can tell whether the programme is actually helping anyone, and they are counts and timestamps, never content. Knowing you hold 340 records tells us you are using it. It tells us nothing about what those records say.

If you turn on sync

Tied to your account, off by default.

Cloud sync exists so you can use HDHICT on a second device or recover from a lost laptop. It stays off until you switch it on.

Your account is the key
Signing in on a second device is all it takes. There is no key to copy across. Your password is stored only as a slow, salted hash, so the password itself never sits in our database.
Encrypted in transit
Snapshots move over TLS to a Postgres database in a single region, stored as one row per workspace.
Forgotten passwords are recoverable
A reset link goes to your email and works once, for an hour. Changing your password signs out every device, everywhere.
Last write wins, deliberately
Sync uses optimistic concurrency. If two devices edit at once, the most recent snapshot wins rather than silently merging your books into something neither of you entered.
Switch it off and it stops
Turning sync off leaves your device working exactly as before, offline. Ask us and we will delete the stored snapshot outright.

Signing in

Why it still works offline.

When you sign in, the server hands back a short signed certificate saying this account is approved. Your copy of HDHICT checks that signature on your own device every time it opens, against a key baked into the app.

That is why an installed copy keeps working on a dead connection: it does not need to ask us anything. There is no daily check-in. The certificate is renewed quietly whenever you are next online, which is also how a closed account eventually stops working offline.

If an account is ever closed, your books remain fully readable and exportable. We will not hold your own records hostage.

Your responsibilities, honestly stated.

Back it up

Browser storage is cleared if you clear site data, use private browsing, or reset the machine. Export a CSV or JSON backup, or switch sync on.

Guard the device

Your session stays signed in for convenience, so anyone who can unlock the machine can read the books. Lock the machine.

Use a real password

Twelve characters minimum, and not one you have used elsewhere. A short phrase you can remember beats a scramble you cannot.

Being straight with you

Who is actually holding this.

HDHICT is run by a student team, not a company with a security department. We think that is a good reason to hold as little as possible, which is why your ledger never reaches us, but you should know it rather than find out later.

Concretely: keep your own CSV or JSON backups, because they are the copy that does not depend on us. If something goes wrong at our end we will tell the businesses affected directly rather than quietly. And if the programme ever winds down, we will give you notice and your data is already on your own machine.

Found something we should fix?

Security reports go straight to us and we would rather hear it from you than not at all.

security@hdhict.com