Organisation separation
Every protected request is scoped to the signed-in user’s organisation. Customer users cannot select or request another organisation’s records.
SECURITY & ASSURANCEClear controls.
Clear controls.
Accountable operation.
A practical overview of how StatusHQ protects access, separates customer workspaces and supports operational resilience.
Ask an assurance question ↗01
Least access
People see and change only what their role and organisation permit.
02
Useful accountability
Operational changes preserve who, what and when.
03
Practical resilience
Backups, controlled sessions and recoverable workflows support day-to-day continuity.
Backend permissions
Owner, administrator, manager, operative and viewer permissions are checked by the server, not merely represented by hidden buttons.
Multi-factor authentication
Authenticator-app 2FA and recovery codes provide an additional barrier if a password is compromised.
Permanent audit trail
Important administrative and operational changes append to an accountable activity record, including who acted and when.
Session control
Users can review and end active sessions. Password resets, disabled users, suspended customers and security resets invalidate access.
Protected uploads
Photos, documents and logos are validated, stored outside executable application code and returned only after an authorised request.
Credential protection
Passwords use one-way hashing. Verification, invitation and reset links are time-limited and designed for single use.
Encrypted delivery
The production service is delivered over HTTPS. Sensitive configuration is separated from public web files.
Recovery copies
Encrypted database backups and separate uploaded-file backups support recovery from operational failure.
Customer controls
Organisation owners control membership, roles, status rules, notification recipients and their own company branding.
OPERATIONAL ASSURANCE
Useful answers for customer reviews.
This page describes controls currently built into StatusHQ. We do not present planned certifications or uncompleted independent tests as achieved.
Customer-controlled workspace data
The customer normally determines why workspace information is used and who may access it. StatusHQ processes that information to deliver and support the service.
UK/EU-oriented deployment
The service is currently designed for IONOS web hosting with MariaDB, encrypted off-site database backups and separate EU Cloudflare R2 file backups.
Investigate, contain and communicate
Suspected security incidents are assessed, access can be revoked promptly, and affected customers will be informed where contractual or legal duties require it.
Questions are welcome
Customers can contact us for security questions, vendor assessments and further information relevant to their proposed use of StatusHQ.
SHARED RESPONSIBILITY
Security also depends on how each workspace is managed.
Customers should assign the least powerful suitable role, remove leavers promptly, require 2FA where appropriate, keep contact details current, review notification recipients and avoid uploading information that is unnecessary for facilities operations.