Security & Trust

HemeraScope application data is stored in a managed PostgreSQL database hosted by Neon, Inc. in the US. Our backend application runs on Render, Inc. in their Oregon (US) data centre. We acknowledge that US hosting introduces international transfer considerations under UK GDPR; appropriate safeguards are detailed in our Privacy Policy (Section 5, International transfers).

Our frontend is hosted on Vercel, Inc., which operates a global CDN; static assets and page requests are served from edge locations closest to the user. Application data itself is stored on Neon and Render in the US, as described above.

• In transit: All connections to HemeraScope are encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints.
• At rest: Database storage is encrypted using AES-256, which is the standard for managed PostgreSQL providers. Backups are also encrypted at rest.

User authentication is managed by Clerk, Inc. (SOC 2 Type II certified). Clerk provides:

• Multi-factor authentication (MFA) support
• Secure session token management
• Brute-force and credential-stuffing protections
• Role-based access control (RBAC) integration

HemeraScope enforces role-based access control with the following principles:

• Roles: Admin and Client, with permissions scoped to the minimum required for each role
• Principle of least privilege: Team members and systems are granted only the access necessary for their function
• Client data isolation:Each client's data is logically separated; clients cannot access another organisation's data

• Client Data(supplier and spend data uploaded into HemeraScope, which we process on a client's behalf): for 60 days after termination the client may export it through the HemeraScope interface, after which it is deleted in accordance with our Data Processing Agreement (Section 11)
• Account data (the user accounts our clients set up to access HemeraScope): retained for the duration of the engagement plus 12 months, then deleted
• Anonymised supplier data: Irreversibly anonymised and aggregated statistical data is retained indefinitely for benchmarking and methodology improvement, as described in our Privacy Policy (Section 11)
• Security logs: Retained for 12 months

In the event of a personal data breach affecting Client Data, we will notify affected clients without undue delay and in any event within 72 hours of becoming aware of the breach, as set out in our Data Processing Agreement (Section 9). Our incident response process includes:

• Immediate containment and assessment of the breach
• Notification to the ICO where required (within 72 hours)
• Notification to affected clients with details of the breach, its likely impact, and remediation steps
• Post-incident review and implementation of preventive measures

• Cyber Essentials: We are working towards Cyber Essentials certification.
• ICO registration:Hemera Intelligence Limited is registered with the Information Commissioner's Office. Registration number: ZC141869

A full list of our sub-processors, including the data they process and their hosting locations, is available on our Sub-processor List. We notify clients of changes to this list at least 30 days in advance.

If you discover a security vulnerability in HemeraScope, please report it responsibly to hemerascope@gmail.com. We ask that you:

• Do not access or modify other users' data
• Do not publicly disclose the vulnerability before we have addressed it
• Provide sufficient detail for us to reproduce and fix the issue

We will acknowledge your report within 3 working days and aim to resolve confirmed vulnerabilities promptly.

For security-related enquiries, contact us at hemerascope@gmail.com.