How we protect your books
Accounts hold sensitive numbers. Here is what we do about that, and what we do not claim.
Sign-in
- Passwords are stored only as salted scrypt hashes. We cannot read them, and we never send them by email.
- Repeated wrong passwords slow down and then block further attempts from the same address and for the same account.
- Forgotten-password links work once and expire after 30 minutes.
- Sessions end after eight hours without use. Changing your password signs out every other device.
- New accounts must confirm their email address before a workspace exists.
Separation
- Each company is stored on its own, apart from every other company. A person sees only the companies they were invited to.
- Roles decide who sees which app, and what they may do in it. Only a company administrator can change the logo, restore a backup or manage users.
- An activity log records who changed what.
The connection
- Hisabra is served over HTTPS. Session cookies are marked secure, are hidden from page scripts and are never sent to other websites.
- Every change you make carries a one-time token, so another website cannot make changes for you.
- Pages are served with a strict content policy that stops injected scripts from running.
Your data stays yours
- The owner can download one backup of the whole company at any time, and restore it with a guided check. A safety copy of the current data is kept before every restore.
- If a trial or subscription ends, nothing is deleted. The workspace becomes read-only and you can still download everything.
- When a workspace is deleted we keep an archived copy for 30 days in case of a mistake, then remove it.
What we do not claim
Hisabra does not yet offer two-factor sign-in, and we do not hold third-party security certifications. If your company needs either one, tell us so we can plan it.
To report a security problem, write to mail@hisabra.com. Please give us time to fix it before sharing details.