Trust

Security

Safety records are sensitive. This page explains, in plain terms, how Ohsvera protects them today.

Your organization's data stays yours

• Every request is checked against the signed-in person's organization, so one organization can never read or change another's records.
• What each person can see and do follows their role: administrator, safety manager, safety officer, supervisor or worker.
• Only the person who filled in an inspection, incident or hazard can change what it says. Reviewers return records for correction instead of rewriting them.
• Hazard reports can be made confidentially. The reporter's name is not shown to reviewers, in emails or in the activity log.

Signing in

• Passwords are stored only as salted scrypt hashes, never in readable form, and must be at least 12 characters.
• Every role can turn on two-step sign-in with an authenticator app, with one-time recovery codes. Authenticator secrets are encrypted (AES-256-GCM).
• Sessions use random tokens. Only a hash is stored, and the session cookie cannot be read by scripts on the page.

In transit and in the browser

• Ohsvera is served only over HTTPS, with HTTP Strict Transport Security.
• Pages cannot be embedded in other sites, and form submissions from other sites are rejected.

Photos and files

• Evidence files are kept in private storage. Each time someone opens one, after an access check, they get a link that works for two minutes.
• Each file gets a SHA-256 fingerprint, so you can show it has not changed since it was added.

A record of who did what

• Important actions are recorded in an audit trail: creating and changing records, reviews, verifications, invitations, role changes and sign-in security changes.
• Administrators can review the activity log and download their organization's records at any time.
• Finalised records are locked. Moves that undo work, such as reopening or archiving a record, need a written reason, which is kept.

AI with limits

• VERA's answers cite the records they used, and AI output is labelled as AI.
• Legal requirements are quoted only from sources your team has verified. VERA never claims you are compliant.
• To answer a question, VERA sends the question and the relevant records to OpenAI. See our privacy summary for everyone who processes data for us.

What we do not claim

Ohsvera does not yet hold a security certification such as SOC 2 or ISO 27001. If your organization needs a security questionnaire completed, ask us and we will answer it honestly.

Report a security concern

If you think you have found a security problem, please tell us through the contact form. Include the word "security", and do not include anyone's personal data.