Security at Firmstead HQ

Last updated: September 5, 2026

Firmstead HQ is being built around company-level data separation, server-enforced access and secure storage.

Current safeguards

• Each company receives an isolated workspace identifier.
• Passwords are salted and computationally hashed.
• Sessions use secure, HTTP-only cookies.
• Sensitive settings require Owner or Admin access on the server.
• Uploaded files and records are restricted to the signed-in company.

Before commercial launch

We plan independent security review, recovery testing, documented backups, incident response procedures and expanded audit history before accepting general paid subscriptions.

Report a concern

Please use the support page and mark the message “Security.” Do not include passwords or other secrets.