How GrowWithHR handles company data

Customer sign-in for complete reports

• GrowWithHR uses Supabase Auth for customer report-access sessions. The browser uses only the Supabase publishable key; the Supabase service-role key remains server-side.
• After an assessment, the website shows a concise executive glimpse. The complete personalised PDF is delivered by email only after the customer signs in with the matching signed-in work email used for that assessment.
• The browser sends a Bearer access token with the report-delivery request. The GrowWithHR server validates that token against Supabase Auth before the existing email-delivery handler can run.
• The server also verifies that every requested report recipient matches the authenticated customer email, so an authenticated request cannot redirect a personalised report to a different address.
• On the public deployment, complete personalised reports are not exposed as public full-report web pages. Complete fictional sample reports remain publicly viewable so buyers can inspect the report format before using the product.

Company Workspace protection

• Reusable Company Workspace data is encrypted before database storage using AES-256-GCM.
• The Workspace Recovery Code is not stored in plaintext; the server compares a stored hash when access is requested.
• A Report ID by itself is not intended to unlock reusable company information.
• Recovered workspace data is returned only after the Report ID and Recovery Code are successfully verified.
• The Workspace Recovery Code model is separate from customer report authentication: it reopens reusable company baseline data, while Supabase Auth controls delivery of complete personalised PDFs.

Cross-tab handoff

When saved company information is reused in another GrowWithHR analysis, the product can create a random one-time handoff token instead of putting the Workspace Recovery Code in the URL. The token expires after a short period and is deleted when redeemed.

Retention and deletion

Reusable Company Workspace data is kept for six months from the latest completed analysis. GrowWithHR schedules a reminder approximately seven days before deletion. A recovered workspace can also request earlier deletion.

Downloaded or emailed reports remain with the customer. Minimal operational records may remain where needed for report identity, security, fraud prevention, system integrity or legal obligations.

Hosting and service boundaries

• The public browser application is served from GitHub Pages.
• GrowWithHR server APIs are currently hosted on Render.
• Supabase provides customer authentication and reusable workspace storage. Browser authentication uses a publishable key; privileged workspace and authentication verification operations use server-side credentials.
• Requested complete report emails are sent through the configured Gmail API integration after server-side authentication checks pass.

Browser-to-API controls

The server uses an approved-origin CORS allowlist rather than a wildcard policy. API requests are validated independently of CORS, and the service applies request-size and rate-limit controls where configured. Complete report-delivery endpoints additionally require a valid Supabase customer access token and recipient-email ownership validation.

What not to submit

GrowWithHR is designed for organization-level company facts. Do not submit employee medical information, payroll records, disciplinary files, performance cases, complaint evidence or other highly sensitive employee-level material unless a future feature explicitly states that it is designed for that data.

Report activity metadata

When an Organization Structure report is downloaded as a fictional sample or a personalised report is securely emailed, GrowWithHR may record minimal operational metadata such as report type, Report ID, company name, authenticated email where supplied, filename, framework/version and event time. The activity notice is not intended to contain the structural findings themselves.

Security reporting

If you believe you found a security issue, do not publish credentials or sensitive details in a public issue. Email hrtechifyed@gmail.com with the subject GrowWithHR security report.