Security: what exists and what does not
We do not have SOC 2 or SSO yet.
If your company needs either one before you buy, Run Hoshin isn't ready for you. This page lists what the product does today, and what it doesn't.
What binds us today
Nothing on this page is a contract. Our terms and privacy notice are in force, so they bind you and us. This page describes what the product does, and you can test much of it in a trial. Before anyone can pay, we publish final terms and name the seller.
What exists
| Control | What it does |
|---|---|
| Your data stays separate from other companies' data. | Every company table has row-level security in the database. A test signs in as one company and tries to read, insert, update and delete another company's rows, in both directions. Any new table must join that test. |
| You look down only. | You can read your own seat's work and the work of the seats below you. You can't read a peer's work. The one box above you shows a name and a title. Company admins can read every seat. |
| The record is append-only. | A change is a new dated row. Effective dates are today or later. |
| Private notes belong to the writer. | Nobody else in your company reads them. A note stays with its writer when the writer changes seats. If the writer leaves, nobody in your company can read it or export it. We have no legal-hold feature. Our staff can read notes only inside a logged visit, and each read goes on your company's record. If you give no consent, or withdraw it, no staff member can read them. |
| A Master can act as someone else. | A Master does what a Company Admin does, changes roles, and can see the app as another person. Each time goes on your company's record under the Master's name. Acting as someone doesn't open that person's private notes. |
| Two-step sign-in. | Anyone who signs in can turn it on with an authenticator app. A company admin can't require it for everyone. Our staff must use it. A staff login that hasn't enrolled goes straight to the enrollment page. |
| Our access needs your consent. | A new company has no consent on file, so our staff can't enter it. You don't need to give consent to use the app. A company admin gives or withdraws it on the Vendor access page, and withdrawing ends every visit at once. The form asks which agreement the consent rests on, and a trial has no agreement yet. |
| A contract setting can limit visits. | The setting can block visits or require your approval for each visit. We set it to match a signed contract. A self-serve company has no signed contract, so its setting stays at None, and consent is your control. |
| You can see each visit we make. | Each visit goes on your company's own record, and your company admins read it. A line shows when, who, whose work, and what happened: entered, left, viewed, made changes, downloaded a report, or opened a named person's private note. Steps in one person's work with no gap over 30 minutes share one line. |
| What the record of a visit leaves out. | A line doesn't name the page, and it doesn't show what changed or what a note says. There are no before and after values. A visit is not read-only: our staff in a visit can make changes. The company's export holds the raw rows, each with the page's route, such as /a3/[id]. |
| Whole-company export. | A company admin can download the company's data as one NDJSON file. The file suits a developer or another program, not a spreadsheet. The export runs as that admin, so it holds what that admin can read. Private notes other people wrote stay out, and so do tokens and login secrets. |
| Deletion after a 30-day wait. | One company admin can ask to delete the company, with no second approval. That admin and the company's first admin get an email, and every page shows a banner during the wait. Any admin can cancel before the date. After the wait, a scheduled job deletes the logins and every row of that company, audit log included. We keep one record: the company ID, a hash of its name, and two dates. |
| AI and your data. | The app has no AI feature, so it sends your company's records to no AI model and trains none. What you send us is different: an AI agent working for us may read it. Every visit runs under a named staff login, and we haven't published a rule on whether an AI agent may hold one. |
What does not exist yet
| Item | Where it stands |
|---|---|
| SOC 2 | We have no SOC 2 report and no dated plan for one. |
| SSO | You sign in with an email address and a password, plus two-step sign-in if you turn it on. We have no dated plan for SSO. |
| Production system | The app doesn't run in production yet. The rows below stay open until it does. |
| Data location | Planned, and it may change: the US East region, near Washington, D.C., for both the app and the database. The final privacy notice will state it. |
| Controlled data | We have not assessed the app for controlled data, such as ITAR, CUI or health records. Don't load that data. |
| Encryption | We have not tested or published encryption in transit or at rest for a production system. We will state it here after we check it. |
| Backups and restore | We have no production backups yet, and no restore test has run. We can't yet say how long deleted data stays in a backup. |
| Uptime | We have no uptime target and no service-level agreement. |
| Breach notice | We have no written commitment on breach notice. |
| Outside testing | No penetration test and no outside human security review has happened. Our AI audit checks that build steps were met. It isn't a security review. |
| Data retention | We have no retention limit. A company's data stays until an admin asks to delete the company, and that includes a trial that has ended. |
| Customer history | No customer has run this product yet, so we have no production security record to show you. |
A known limit
Row-level security trusts a short-lived token that the app signs. Someone who holds both the database login and the app's signing key could forge that token. We keep the key out of the code repository, and the app's database login can't read the database's copy of it. A compromise of the app's hosting environment is outside what this protects against.
Who else handles your data
See the subprocessor list. To ask a security question or report a problem, write to support@runhoshin.com. We publish the same address in security.txt.
Test it for yourself
You can test much of this page in a trial, with no card.