Security

Version 1.8.3 (beta) · 15 October 2026

How H6YS Studio protects your information during the beta.

(a) Where it is held. The database is in London, with Supabase. The site is hosted by Vercel. All the accounts are held by Humphreys Law, not by any developer.
(b) Encryption. Information is encrypted in transit (HTTPS) and at rest by our providers.
(c) Passwords. At least 12 characters, checked against lists of known breached passwords, and stored only in scrambled (hashed) form. Nobody at Humphreys Law can see them.
(d) Who can see a deal. Only the people who are members of it. This is enforced in the database itself, not just by hiding things on screen. Being an administrator does not open a deal.
(e) Sessions. You are signed out after 30 minutes without activity (with a warning first) and after 12 hours in any case. Changing your password signs you out everywhere else.
(f) Monitoring. Sign-ins, failed attempts and administrator actions are recorded in an audit log. The log never holds passwords or deal content.
(g) Two-factor sign-in. An authenticator app is available now and is optional. It becomes required for every account before the Studio opens more widely, together with Microsoft sign-in for Humphreys Law users and an independent penetration test, and all of those come before any real client or deal information is used.
(h) Sample information only. During the beta, do not enter real client or deal information.
(i) Reporting a concern. If you think something is wrong, email hedz@humphreys.law straight away.