Security at ProgramHub

Every tenant table in our database carries row-level security scoped to the caller's organization. Access decisions are enforced at the database row level, so isolation holds even if application code is wrong. Within an organization, capability is gated by role — advisors work their own caseload, managers get organization-wide reporting, admins manage users and directory.

The resident portal is scoped per household by a validated, signed session — a resident only ever sees their own record. Any cross-organization or cross-household read is classified as our highest-severity incident and is covered by an automated isolation test.

ProgramHub stores no passwords, which removes an entire class of breach (credential stuffing, password reuse, bulk theft). Staff and contractors sign in with expiring, single-use email links.

Two-factor authentication with an authenticator app (TOTP) is required for staff accounts — a compromised mailbox alone cannot reach the application. Residents authenticate with a single-use link plus a date-of-birth second factor, rate-limited with lockout; portal tokens are stored only as one-way hashes, never in the clear.

Single sign-on for staff (Google Workspace, then SAML) is on the roadmap below.

All data is encrypted in transit with TLS and at rest with AES-256, across the database, file storage, and email delivery. Uploaded documents live in a private store, are restricted to PDFs with content-type validation, and are screened for manipulated content before any automated processing trusts them.

The most sensitive category we hold — income and public- assistance status — is never exposed to contractors and never sent to analytics. We keep a maintained inventory of every sensitive data type and where it is stored.

Changes reach production only through pull requests into a protected main branch, with required, always-current automated checks (build, lint, tests, type-checking) and an automated dependency-audit gate that fails the build on a high-severity vulnerability in a production dependency. Weekly dependency scanning and security advisories run continuously.

Changes that touch authentication, tenant isolation, the resident data path, secrets, or a third-party data flow receive an additional, documented adversarial security review before they merge.

Application errors are monitored in real time. We maintain a written incident-response plan with a severity ladder and defined containment steps. For any incident affecting a partner organization's data, we commit to notifying that partner within 72 hours of confirmation, followed by a post-incident review shared with those affected.

Application audit events are retained indefinitely; infrastructure and access logs are exported daily to durable storage and kept for at least 180 days.

Company devices run full-disk encryption (FileVault) with an enforced screen lock, and no production resident data is copied to them — development uses seeded or synthetic data. Secrets are held in environment configuration, never committed to source control, and rotated on any suspected exposure.

ProgramHub runs no servers of its own. We rely on a small set of managed providers, each holding SOC 2 certification (most at Type II — see the table), and share only the data each one needs to do its job. Physical security, hardware, and network controls are inherited from these certified platforms. All resident data is processed and stored in the United States.

Data-processing agreements with these providers are in place or in progress. We notify partners at least 30 days before adding a subprocessor that touches resident data.

ProgramHub processes resident data on behalf of the implementer organizations that use it — they are the controller, we are the processor. We do not sell personal data, use it for advertising, run analytics on income data, or train AI models on it. We enter into a data-processing agreement with each organization we serve, and return or delete its data on request when an engagement ends. See our Privacy Policy for how we handle information from visitors and users.

We are transparent about what is in flight rather than claiming a finished program. On our near-term roadmap:

• Single sign-on for staff (Google Workspace, then SAML)
• DMARC enforcement and MTA-STS on our sending domain
• An independent third-party penetration test, then annually
• A SOC 2 examination for ProgramHub itself
• Publishing our formal privacy policy after legal review

Security questions, documentation requests (SOC 2 reports from our providers, our security posture summary, or policies under NDA), or reports of a suspected vulnerability: security@wearemonuments.com. We investigate every good-faith report and will not pursue researchers who act responsibly.