Security and compliance

Access and separation

  • Every request is checked against the organisation that owns the evaluation.
  • Contributors only ever see their own scorecard.
  • Vendor links are scoped to one vendor, expire, and can be revoked at any time.
  • Passwords are stored as salted scrypt hashes; PINs the same way.

Your data

  • Documents are stored as extracted text, inside your workspace.
  • Nothing is shared between organisations, and nothing is used to train a model.
  • Demo workspaces are deleted automatically, including everything in them.
  • The decision pack and CSV export mean your records are never locked in.

AI processing

  • The independent evaluation sends evaluation text to a model provider when the AI tools are enabled.
  • On a private instance you choose the endpoint, including a model on your own hardware.
  • With AI switched off, the lexical and language engines still run locally.

Audit trail

  • Every change is recorded with actor, action and timestamp.
  • Sign-offs record the signatory, the meaning and the moment.
  • Locking makes scores read-only; decided is final.

Reporting a problem

Found a security issue? Write to info@h-lsc.com and we will come back to you.