last updated 24 October 2026 · Human Forward LTD · hello@humanforward.io · United Arab Emirates
Security
We build software that sits close to a brand's store, its customers and its community. That only works if you can trust us with it, so security is a design decision here, not a department. This page says how we think about it. It deliberately does not describe our systems in detail, because a page that helps you also helps an attacker.
The short version
- Your data is encrypted in transit and at rest
- We do not see or store card numbers. Payments run through Stripe and Shopify, who hold the relevant PCI certifications
- Every Human Forward account, system and supplier login is protected with multi factor authentication, and passkeys wherever they are supported
- Secrets and keys live in a managed vault, never in code, chat or documents
- Access follows least privilege: people and services get the minimum they need, and admin access is separate from day to day accounts
- We run on major cloud platforms (Google Cloud, Vercel, Stripe, Shopify) and inherit their physical, network and platform controls
- Dependencies, images and runtimes are kept current, and we watch for published vulnerabilities in what we use
- Production is logged and monitored, and we keep the logs we need to investigate, nothing more
Standards we work towards
We are a young company and we would rather tell you what we are aiming at than claim badges we have not earned yet.
| Standard | Where we are |
|---|---|
| Cyber Essentials Plus (UK NCSC) | Certification in progress |
| UK GDPR and EU GDPR | In place. Registered with the ICO, reference ZC279404. Our Privacy Policy and DPA have the detail |
| OWASP Application Security Verification Standard | Used as the checklist for how we build and review our apps |
| ISO/IEC 27001 | Our controls are modelled on it. Formal certification is on the roadmap as the team grows |
| PCI DSS | Out of scope by design: card data never touches our systems. Stripe and Shopify are Level 1 service providers |
| Shopify App Store and the Claude, ChatGPT and Muse directories | Each has its own security and privacy review. Our apps have passed, or are in, those reviews |
Honest about the limits
No service is completely secure, and the pace of change in AI and cloud tooling means the threats keep moving. What we commit to is using current tools, current platforms and current practice to stay on top of it and, where we can, ahead of it. When something does go wrong we tell affected customers quickly and plainly, and we have moved providers before rather than accept a risk we were not comfortable with.
Our own AI tools
The AI engines and agents our products call receive the minimum needed to do the job, under business terms that do not allow your data to be used for training. Our AI transparency page lists the providers. Agents acting on your behalf run on policies you set, with a person on the exceptions.
Reporting something
If you think you have found a vulnerability in anything we run, email hello@humanforward.io with Security in the subject. A person reads it, you get an acknowledgement within two working days, and we will not take action against good faith research that stays within the law, avoids other people's data and gives us reasonable time to fix the problem. Please do not test against production customer data or run denial of service.
Questions from your security team
Procurement and security questionnaires are welcome. Send them to hello@humanforward.io and we will complete them, under NDA where you need one.