Security & trust

Version 0.1 (draft) · 12 July 2026 · P2.6: the ethics moat, written down.

The headline: privacy that is enforced, not promised

Most tools promise not to look at sensitive data. HEARTBEAT is built so that looking is impossible:

• Individual wellbeing is cryptographically sealed. Pulse entries are stored only as keyed HMAC hashes. There is no decrypt path. The permission system carries hard denials that outrank every role — including our own super-administrators — and those denials are unit-tested.
• Voice never records. Listening happens only while the mic is physically held; audio becomes text and is discarded. Every voice-initiated write reads back a confirmation card that cannot be disabled — the "confirm lock" is a structural property, not a setting.
• Tenants are isolated at the database. Row-level security plus per-request organisation scoping — two independent walls.

Platform security

• Passwords: scrypt (OWASP parameters); sessions: server-side, revocable, HttpOnly cookies; optional TOTP MFA with recovery codes.
• Every API input schema-validated; the query language compiles to parameterised filters (injection-tested).
• Rate limiting on every endpoint with strict budgets on authentication routes.
• Administrative actions audit-logged; "access explain" lets administrators see exactly why any permission is granted or denied, with rule citations.

Responsible disclosure

Found something? Please write to [security@yourdomain — placeholder]. We commit to acknowledging within 48 hours. A formal vulnerability disclosure policy and security.txt ship with the launch wave.