Passwords
Hashed with argon2id. We never see or store them in readable form.
Security
A compliance tool has to be trustworthy first.
Here's exactly how Hera protects your data, your keys and the evidence you hand to regulators.
Sessions
Random tokens in HttpOnly, SameSite cookies. Only a hash is stored, and sessions slide out after 30 days.
API keys
Shown once, stored as a keyed hash, scoped, revocable, and never accepted from a browser by the SDK.
Webhooks
Every delivery is HMAC-signed with a timestamp so replays fail. Secrets are encrypted at rest.
Tenant isolation
Every row belongs to one organization and every query is scoped to it.
Tamper-evident audit log
Each entry stores the hash of the one before. Verify the whole chain in one click.
Verifiable reports
PDFs carry SHA-256 hashes. Anyone can check a copy is genuine without seeing its contents. Verify a report
Personal data
IVMS101 data appears only where it's needed and never in org-wide reports. EU hosting for Enterprise.
Our own intelligence
No resold vendor data. Every label shows where it came from and how confident we are.
Found a vulnerability?
Email security@heralayer.com. We reply within one business day and credit researchers who report responsibly.