Security & trust
Safety records are the evidence that stands between your organisation and its worst day. Before you trust ours with them, you deserve specifics — not a wall of badges. This page is the honest state of FreeHS security. Where something is on the roadmap rather than done, it says so.
Data isolation
Every workspace is separated by PostgreSQL row-level security — a policy on every one of the 40+ tables in the schema, enforced by the database itself rather than by application code remembering to filter. A query from your workspace cannot return another workspace's rows, even if the application layer has a bug.
That isn't a promise we keep by being careful — it's one we keep by machine. Our continuous integration checks that every table carries a row-level security policy, so a new table cannot ship without one.
Tamper-evident audit trail
Every create, change, approval and decision is written to an append-only audit trail. The database roles the application uses hold no update or delete grants on it — events can be added, never edited or removed.
Each workspace's trail is also a SHA-256 hash chain: every event carries the hash of the one before it, so altering or removing a record breaks the chain and is detectable. If someone unsympathetic reads your records one day, this is what makes them stand up.
Authentication
Sign-in is passwordless — a short-lived code sent to your work email. There is no password to phish, reuse from a breached site, or write on a whiteboard. A code works once, then it's dead.
Hosting & residency
Your safety records are stored in a UK database — Supabase's London region — encrypted in transit with TLS and encrypted at rest. The application layer runs on Railway's europe-west4 region (Netherlands, EU), the closest Railway region to the data; requests transit the EU, and the records themselves stay in the UK.
Your exit
Lock-in is not a retention strategy we're willing to use. Any workspace member can export every record their membership can see — including the full audit trail — as JSON with one click, at any time, no questions asked and no export fee. If FreeHS ever stops deserving your trust, you leave with everything.
What we don't do
No advertising. No selling or sharing of your data — not anonymised, not aggregated, not ever. No tracking beyond what's needed to operate the service: sign-in, error logs, and the audit trail you can read yourself. If a behaviour would surprise a reasonable safety practitioner, we don't do it.
Where we are
FreeHS is young, and it would be dishonest to pretend otherwise. Independent penetration testing, a published data protection impact assessment (DPIA) and formal certifications — Cyber Essentials, then ISO 27001 — are on the roadmap, not yet done. As each one lands, this page will say so plainly. Until it does, assume it isn't done.
What FreeHS is and isn't
FreeHS is a management tool. Using it does not, by itself, discharge any legal duty — your duties are met by what your organisation actually does, and the records here are evidence of that, not a substitute for it.
Where FreeHS drafts content for you, that draft is machine-generated, marked as such, and is a starting point only. A competent person must review it, adapt it to your actual workplace, and sign it. How that works is set out in how content is governed.