Security & data handling
What we do with your data
A plain-English page for the question every procurement reviewer and executive director needs answered before adopting a new tool. For deeper review, email doug@werqhub.org and we’ll work through your vendor security questionnaire directly.
Where data lives
WERQ Hub runs on Supabase Postgres in a US-West region (Oregon). All database storage is encrypted at rest by the underlying provider (AES-256). All connections to the application use TLS 1.2+ in transit.
Authentication is handled by Supabase Auth (magic-link + OAuth where applicable). We don’t store passwords.
Who sees your data
Your peer/case data stays inside your organization’s workspace. Other organizations on WERQ Hub don’t see your peers, your cases, your referral logs, or your internal notes — ever. Postgres row-level security enforces this at the database layer, not just in application code.
Two things are shared across the network: the Journey library content (the published protocols + steps + resources) and aggregate, anonymized usage metrics (counts of Journeys opened, referrals generated). No peer-identifying data is ever included in shared metrics.
Cross-org sharing only happens through explicit Partner agreements that both orgs accept, or with explicit peer consent on a specific case.
Our HIPAA stance
WERQ Hub is not a HIPAA-covered entity and we don’t sign Business Associate Agreements (BAAs) at this time. We treat the data as if we were — encryption at rest and in transit, principle of least privilege for staff access, access-logged admin actions — but we’re honest that we’re not a HIPAA shop today.
For most community-org case management work, this is fine. PHI-heavy clinical workflows should use a HIPAA-covered EHR for the clinical record, with WERQ Hub as the case-coordination layer.
Staff access and audit
A small number of WERQ Together staff (WERQ staff + the engineering team) have admin access to the production database for operational support and platform maintenance. Every admin action that touches user/org/case data is logged in an append-only audit log we can produce on request.
We don’t access peer data unless you ask us to (e.g., for a support ticket).
Backups and data export
Daily database backups are kept by our infrastructure provider for at least 7 days. Point-in-time recovery is available within the same window for disaster scenarios.
Your data is yours. You can request a full export of your organization’s cases, peer data, and referral logs at any time by emailing doug@werqhub.org. We aim to deliver within 5 business days.
Incident response
If we identify a security incident affecting your organization’s data, we’ll notify you by email within 72 hours of confirming the incident, with what we know and what we’re doing about it. Follow-up communications continue until the incident is resolved.
We’ve had no security incidents to disclose.
What we’re not (yet)
To be straight with you: we’re a small nonprofit, not a large SaaS company. We don’t have SOC 2 Type II, we’re not ISO 27001 certified, we don’t have a dedicated security team, and we don’t maintain a public security disclosure program at this stage.
What we do have: engineers who care about not screwing this up, a small attack surface, sensible defaults from the platforms we build on, and a willingness to talk through specific concerns your organization has.
Vendor security questionnaire
If your organization requires a completed vendor security questionnaire, send it to doug@werqhub.org and we’ll fill it out within 5 business days. Most reviewers tell us this page covers 80% of what they ask, so we appreciate you starting here.