Security
Controls you can understand.
Access rules and data controls should have an explanation. These are the mechanisms CoreHQ uses for workspace and client data.
Manual agency approval · No subscription
Roles enforced on the server
Admin, member, and client role floors are checked on the server for protected actions.
A company-scoped client portal
Client portal reads are scoped to the signed-in client’s own company records within the workspace.
Password and authentication controls
Passwords are hashed with scrypt, and authentication endpoints apply rate limits.
OIDC single sign-on
Connect an OIDC identity provider and optionally enforce SSO for the workspace.
Encrypted accounting tokens
QuickBooks Online and Xero OAuth tokens are encrypted at rest using AES-256-GCM.
Application-level audit trail
CoreHQ records key application actions in a workspace audit trail for review.
Signed webhooks
Outgoing webhook signatures let receivers verify requests, and incoming Stripe webhook signatures are checked.
Workspace data export
A one-click JSON export provides your workspace’s core records.