Security at Hammock

Last updated [date]

We handle our Clients’ financial and personnel information, so we keep our security program simple, written down, and checkable. Here is how it works.

Hold less. Our default is to work inside your systems — your accounting, payroll, HR, and bank platforms — through named accounts you control and can revoke. Sensitive personnel data (Social Security numbers, bank details, medical and leave records) stays in your systems; if it reaches ours, it lives in a restricted folder and is removed within 30 days of the task closing.

Access. Multi-factor authentication is required on every system we use. Each person has their own account; nobody shares logins. Access is reviewed quarterly and removed within 24 hours when someone leaves.

Devices. Laptops are encrypted, auto-updated, and locked when idle. Client data does not go on personal devices.

The Platform (Atlas). Hosted on Google Cloud in the United States. Data is encrypted in transit and at rest. The production database is backed up daily with point-in-time recovery. Access to production is limited to named engineers in the US; our offshore development partner works only in test environments with synthetic data. Security headers, dependency scanning, and secret scanning run in our build pipeline.

AI. We use AI tools to help our team work, with a human reviewing anything before it becomes a deliverable. Our AI providers are contractually barred from training on your data. Sensitive HR data is handled only in approved business AI accounts that do not train on it, is never used for benchmarking or service improvement, and identifiers such as Social Security numbers, account numbers, and medical records are kept out of AI tools altogether. You can opt out of de-identified benchmarking in Settings › Privacy & Data.

Vendors. Every vendor that touches Client data signs data-protection terms and is listed, with what it receives and where, at gethammock.com/legal/subprocessors. We give 30 days’ notice of changes.

Payments. We never hold your funds and are never a signatory on your accounts. Where you give our team a user role in your bank or payment platform, we release only payments you have approved; bank-detail changes are verified by a call to a number we already have on file; and two Hammock people are involved in every payment setup and release.

Incidents. We have a written incident-response plan that we rehearse in tabletop exercises [first exercise scheduled for — date]. If we confirm unauthorized access to your data in our systems, we tell you within 72 hours and give you what you need for your own obligations.

Certifications. We do not currently hold SOC 2 or ISO 27001 certification. We are happy to complete security questionnaires and to walk through our controls with your team. Contact security@gethammock.com.