Trust and security
This page exists so that someone evaluating GuideHerd can read what we actually do, without a call. It describes controls that are in place today. Where something is not in place, it says so — a trust page that lists only strengths is a sales page.
What no one has done
Start here, because it is the question a reviewer is really asking.
No outside party has assessed GuideHerd’s security posture. There is no independent report, no external review, and no third-party examination of any kind. We hold no formal recognition from any standards body or industry program, and we do not describe ourselves as having one. Anything on this page is our own statement about our own systems.
If that changes, this page will name who did the work, what they looked at, and when — rather than implying it.
Controls in place today
Each of these is something the platform does, not something we intend to do.
Separation between organizations
Every organization’s data is scoped to that organization at the storage layer. Reads and writes carry the organization with them, and a request that reaches for another organization’s data fails rather than returning something. This is covered by tests that run against both storage implementations on every change, so the separation is a contract rather than a convention.
Credential handling
Credentials are never rendered in our interfaces and never written into our logs. They live in the hosting platform’s own secret storage, are referenced by name in code, and a scan runs on every change specifically to refuse a secret entering the repository. Sessions use cookies marked HttpOnly and Secure.
Change history
Configuration changes are versioned and auditable, and reversible one at a time. Scheduling activity and privileged administrative writes keep their own audit trail, so a change can be explained after the fact rather than reconstructed. That record is what lets us answer “who changed this, and when” with something other than a guess.
Change management
Nothing reaches production without review and an automated gate. Every proposed change runs the backend suites against both an in-memory store and a real database, the frontend suites, an accessibility pass, a security-headers and content-security-policy check, a dependency review, and a secret scan. A change that fails any of them does not merge.
Capabilities are off until enabled
A capability nobody has configured is not running and holds nothing. Telephony, messaging, practice-management connections and voice are each dark until an organization deliberately turns them on, and each can be disconnected by that organization at any time.
Data location and custody
Production runs in a single United States region. The platform is designed as a transfer buffer rather than a repository: documents come to rest in the firm’s own storage, and delivered mail and calendar events live in the firm’s own systems. Our Privacy Policy lists every service provider involved and what each one receives.
Answering a data request
An organization can have the records tied to one person exported or erased. The erasure is recorded so that restoring a backup cannot quietly bring erased records back — a hazard that is easy to miss and that we handle deliberately.
Availability and observation
The platform is watched from outside itself on a regular interval, and the result is published to our service status page, which is hosted separately and holds no connection to the platform. It therefore keeps working, and keeps telling the truth, during an outage. Threshold alerting runs against durable windows rather than momentary blips.
What we have not done
These are real gaps. They are listed because a reviewer will find them anyway, and finding them here is better than finding them later.
| Area | Where it stands |
|---|---|
| Formal written policies | Information security, access review, joiner and leaver, incident response and continuity policies are largely undocumented as formal policies, though several of the practices they would describe are in place |
| Access review cadence | Access to production is limited to the people who need it, but a recurring documented review is not yet established |
| Log retention | Retention periods for operational logs are not documented, and are carried as a known risk rather than settled |
| Backup coverage | The operational database has point-in-time recovery and scheduled backups. The configuration store is not covered by the same mechanism — a known gap, recorded rather than assumed away |
| Redundancy | Production is a single region and a single replica. That is a deliberate, recorded acceptance for the current stage, not an oversight |
| Independent assessment | None, as stated above |
Reporting a security problem
If you find a security issue, write to hello@guideherd.ai before disclosing it publicly, and give us a reasonable chance to fix it. We will not pursue good-faith research that stays inside the boundaries in our Terms of Use. We do not run a paid bounty program.
Where to look next
- Platform — every integration named, each labelled with where it actually stands
- Privacy Policy — what is collected on each surface, and every service provider involved
- Terms of Use — acceptable use, responsibilities, and what a written agreement covers instead
- Service status — current availability, observed from outside the platform
How this page is kept honest
Maintained by: GuideHerd engineering, in the public guideherd-site repository, alongside the rest of this website. It is reviewed whenever the underlying posture changes — a new service provider, a closed gap, an assessment completed.
Nothing here is copied from our internal customer documentation. That material is written for firms already using GuideHerd and assumes context a public reader does not have, so it stays private; this page was written separately for people evaluating GuideHerd, and each statement was checked against what the platform actually does. Its claims are covered by the same automated checks that refuse unearned capability claims everywhere else on this site, so a stronger statement cannot be added by copy-edit alone.
If something here is out of date, or you need detail this page does not carry, write to hello@guideherd.ai and say what you are evaluating.