Contact us
Log in

Security

✓Encrypted in transit✓Encrypted at rest✓EU-hosted✓Independently audited

At hidma, security isn’t an afterthought – it’s how we’ve built the product from day one

hidma stores some of the most sensitive data a professional services business has: time, billing, client relationships and revenue. We treat that data with the care it deserves. This page describes the practices, controls and design choices that keep your information safe.

A platform built around isolation

Every hidma customer’s data lives in its own dedicated, fully isolated database. We don’t use shared tables for business data – your clients, projects, timesheets and invoices never share storage with another organisation’s records.

This separation is enforced at the infrastructure level, not just in software, which means a request authenticated for one organisation cannot reach another organisation’s data, even by mistake.

Encryption everywhere

  • In transit. All connections to hidma are encrypted using TLS 1.2 or higher. We don’t accept unencrypted traffic.
  • At rest. All customer databases run on encrypted infrastructure. Database volumes are encrypted using AES-256, and database backups are independently encrypted using AES-256 with per-file keys. Encryption is provided and managed by our infrastructure partner, DigitalOcean.
  • Credentials. Passwords are stored using industry-standard credential-protection practices and are never accessible – even to hidma engineers.

Modern authentication

  • hidma uses modern, token-based authentication with short-lived sessions and automatic, secure session refresh. In practice, this means:
  • Sessions are protected against common token-theft attacks by design.
  • Every user must verify their email address before they can sign in.
  • Session credentials are delivered to the browser using hardened, encrypted cookies that cannot be read by malicious scripts.
  • Repeated failed sign-in attempts are automatically slowed and then blocked, protecting accounts against password guessing and against attacks that try one common password across many accounts.
  • You are emailed immediately if your account is signed into from a device we don’t recognise.
  • Every user can review the sessions on their own account and end any they don’t recognise. Administrators can deactivate a user to prevent further sign-in.


We’re actively expanding our authentication options – multi-factor authentication (MFA) and tenant-level enforcement of MFA are on our near-term roadmap.

Protecting your account

Passwords get guessed, phished and reused. hidma is built on the assumption that one will eventually be compromised – and that what matters then is how quickly you find out and how quickly you can take the account back.

 

  • You’re told when something changes. If your account is accessed from a device we don’t recognise, we email you straight away. These alerts can’t be switched off – an alert you can disable isn’t an alert.
  • You can see where you’re signed in. Every user can review their active sessions and end any one they don’t recognise, without going through an administrator. Signing out everywhere covers every organisation you belong to, not only the one you’re currently in. Your password is required before any session is ended.
  • Your email address is protected. Because your email address is your login, changing it takes more than being signed in. Ownership of the new address has to be proven, your previous address is always notified and given a one-click way to reverse the change and sessions are ended while a change is pending.
  • Guessing doesn’t scale. Failed sign-ins and password-reset requests are both rate-limited, per account and per source. Nobody can grind away at a password, and nobody can use password resets to flood one of your users’ mailboxes.

Granular access control

Not every user in your organisation should be able to see everything, and hidma makes that easy.

  • Roles like Team Member, Team Manager, Project Administrator, HR Manager and Director come pre-configured for typical professional services structures.
  • Fine-grained permissions let administrators customise exactly which actions a user can perform – view a client, approve a timesheet, issue an invoice, configure rates and so on.
  • Team-based visibility keeps each team’s data scoped to that team by default, with controlled sharing when cross-team collaboration is needed.

The result: users see only what they need to do their jobs, and nothing more.

A complete audit trail

Every meaningful change made inside hidma – to invoices, timesheets, projects, clients, users, rates and configuration – is recorded in a permanent audit log capturing who changed what, when and from where. Authentication events are logged separately. This trail is available for review by authorised administrators and forms part of our incident-response toolkit.

Secure software development

  • Code review. All changes are peer-reviewed before they reach production.
  • Automated testing. hidma is supported by an automated test suite that runs on every change.
  • Dependency monitoring. Third-party libraries are continuously monitored for security advisories.
  • Static analysis. Code is checked automatically for common security and quality issues.
  • Least-privilege deployment. Production systems run with the minimum permissions needed to operate.
  • Independent security review. hidma is subject to periodic security testing aligned with OWASP methodologies, including penetration testing performed by external specialists. Findings are tracked through to remediation as part of our standard engineering process.

Infrastructure & hosting

hidma is hosted on DigitalOcean, in Frankfurt, Germany. All customer data – including backups – is stored within the European Union. Our hosting provider is independently audited against rigorous security standards including ISO 27001 and SOC 2.

  • Network isolation. Production systems sit behind a hardened network perimeter; databases are not directly exposed to the public internet.
  • DDoS protection is provided at the network edge by our infrastructure provider.
  • We continuously monitor system health, error rates and unusual activity, with automated alerts on anomalies.

Backups & business continuity

Customer data is backed up automatically on a regular schedule. Backups are encrypted, stored separately from production data and retained according to our retention policy. Backup-restore procedures are tested periodically.

In the event of a major incident, our recovery objectives are designed to minimise both downtime and data loss.

Privacy & data ownership

  • Your data is yours. You retain ownership of all data you put into hidma. You can export it, and you can request its deletion when you stop using the service.
  • hidma is built to support customers’ GDPR obligations, including subject access requests, deletion requests and clear records of data processing.
  • No selling of data. We do not, and will never, sell customer data to third parties.
  • A current list of the third-party services that process data on our behalf is available on request.

For full details, see our Privacy Policy.

Integrations

When hidma connects to third-party platforms (such as Xero), we use OAuth so that your credentials for those platforms are never shared with us. Inbound webhooks are cryptographically verified before being processed.

Your role in keeping data safe

Security is a shared responsibility. To get the most protection out of hidma:

  • Use a strong, unique password.
  • Don’t share login credentials between users – give each person their own account.
  • Review user access regularly, and deactivate accounts when people leave your organisation.
  • Keep the email address linked to your account secure, since it controls password recovery. hidma will always notify your existing address before an email change takes effect, and gives you a one-click way to reverse one you didn’t ask for.
  • Use modern, up-to-date browsers.

Reporting a security concern

If you believe you’ve found a security vulnerability in hidma, please report it to security@hidma.com. We treat all reports confidentially and will acknowledge receipt within 2 business days.

We ask researchers to give us a reasonable opportunity to investigate and remediate before publicly disclosing any findings.

Questions?

For security or compliance questions related to procurement, due diligence or your contract with hidma, please contact info@hidma.com. We’re happy to provide additional information under NDA where appropriate.