Security
Plain answers to the questions your IT department will ask before anyone signs up. These hold for every PraxysEHS tool; where a tool differs, we say so.
- Where is our data stored?
With Cloudflare, in data centers in North America. Cloudflare's platform, including the compute, database and file storage we run on, is independently audited for SOC 2 Type II and certified to ISO/IEC 27001. Those are Cloudflare's reports, not ours; your IT team can request them from Cloudflare under its standard non-disclosure agreement.
- Is it encrypted?
Yes. Every connection uses HTTPS over TLS 1.2 or 1.3; older versions are refused, and browsers are told never to connect without HTTPS. Stored data, files and backups are encrypted at rest.
- Who can see our records?
Only people your administrators add, and only what their role allows. Each organization's data is kept separate: every request is checked against the organization it belongs to, and an automated check holds us to that on every change we ship.
- How are passwords handled?
Passwords must be at least 12 characters and are stored only in hashed form, which can't be read back, not even by us. Sign-in attempts are limited, and resetting a password signs out every other session.
- Can our pages be copied or framed by another site?
No. Our pages refuse to load inside another site, and the documents we produce run under strict rules about what they may load.
- Do you keep backups?
Every night, for 90 days. A deleted record ages out of the backups when those 90 days are up.
- Who else handles our data?
Cloudflare for hosting, storage, backups and email delivery, and Microsoft for our support inbox, only for what you choose to send us. Payments go straight to Stripe; card numbers never reach our servers. Our source code is kept in a private repository, and no customer data is stored there.
The full list for each tool is in its Data Processing Addendum, and we give your administrators at least 30 days' notice before adding anyone new.
- What if something goes wrong?
If we confirm a breach that affects personal information in your account, we tell your administrators without undue delay, share what we know, and give you what you need to meet your own obligations.
- Do you sell or share our data?
No. Full stop.
- Can we get our data out?
Any time. Administrators can download everything in your account, with no export fee and no phone call first.
- Will you fill in our security questionnaire?
Yes. Send it to support@praxysehs.com and a person answers it directly.
Tool by tool
Each tool has its own sign-up, its own sign-in and its own data. Nothing is shared between them.
Human Factors Incident Analysis
- A bot check guards sign-up and password resets.
- Cases marked sensitive are limited further, to the people named on them.
- Once a case is signed, the database itself refuses changes. Reopening it is a recorded step by an approver or administrator, and the original sign-off stays in the record.
- Uploads are limited to photos, PDFs, recordings and common office documents, up to 25 MB each. Nothing uploaded can run in a browser, and each file is fingerprinted (SHA-256) when it arrives, so a copy can be checked against the original years later.
- Shared download links expire, and an administrator can cancel one early.
Contractor Management
- A lost lobby tablet can be disconnected from your account at once.
- When a certificate of insurance or a license card is uploaded, Anthropic reads it so the dates can be filled in for you to check. Its terms bar using it to train AI models, and we keep only what you save.
- The full list of who handles its data is in the Contractor Management Data Processing Addendum.
Found a security problem?
Email support@praxysehs.com with “Security” in the subject. A person reads it, and we'll keep you posted on what we do about it.