DATA PROTECTION
Security & Trust
HALO Finance is built as a tenant-isolated platform. Security is applied at the server and database-query layer rather than relying only on what the browser displays.
Application safeguards
Tenant isolation
Financial records are queried using the authenticated tenant ID. Record-level operations are scoped server-side so another workspace cannot be selected simply by changing a browser request.
SQL protection
Database access uses PDO prepared statements and whitelisted write fields to reduce injection risk.
Authentication
Passwords are stored using PHP's adaptive password hashing. Logins are rate-limited after repeated failures and sessions are regenerated after authentication.
Session protection
Cookies are HttpOnly, SameSite=Strict and Secure when HTTPS is active. Authenticated sessions expire after inactivity and have an absolute lifetime.
Request integrity
State-changing API requests use CSRF tokens. Security headers restrict framing, content types, browser permissions and external resource loading.
Audit trail
Security-sensitive activity and important workspace changes can be recorded in an append-only application audit log available to platform administrators.
Uploads
Invoice logos are limited by MIME type and size, use randomised filenames, and executable PHP files are denied inside the upload directory.
Incident process
HALO Admin includes an incident register and compliance checklist so suspected compromises can be documented, contained and escalated.
What we do not claim
No software can promise absolute security. HALO Finance does not claim that application controls eliminate every possible risk. Hosting, database backups, server patching and provider-level encryption must also be maintained as operational controls and are tracked in HALO's compliance checklist.
Report a security concern
If you believe a HALO Finance account or dataset may have been compromised, contact createdbyhalo@gmail.com as soon as possible. Do not include passwords or unnecessary personal information in the report.