Security
Last updated October 13, 2026
Utilities and local governments trust HP Solve with records they are accountable for. This page describes how we protect them, what we have and have not had audited, and who to ask when your procurement process has questions.
What is audited, and by whom
HP Solve runs entirely on infrastructure providers that each maintain a SOC 2 Type II report, and in most cases ISO 27001 certification, covering the physical security, network, availability, and operational controls of their platforms. They are listed below with links to their trust pages, and we can help you obtain their reports where the provider makes them available.
HydroPro Solutions has not completed a SOC 2 audit of its own. The controls that are ours, not inherited from a provider, are the application controls: how we authenticate users, how we keep one organization's data separate from another's, how our staff access production, and how we build and release software. Those are described on this page so you can evaluate them directly, and we answer security questionnaires about them in writing.
| Provider | What it does | What it handles | Location | Their attestations |
|---|---|---|---|---|
| Vercel | Hosts the application and runs its server code. | Everything that passes through the application in the course of serving a request. | United States | SOC 2 Type II, ISO 27001 |
| Supabase | The Postgres database that stores your organization's records. | Assets, forms, events, work orders, users, and settings. | United States (AWS us-east-1) | SOC 2 Type II |
| Cloudflare | Stores and serves uploaded photos (Images), stores attached documents and import/export files (R2), streams uploaded video (Stream), and screens public forms for bots (Turnstile). | Photos, documents, and video you attach to assets and events, including the resized copies Images makes for thumbnails; the bot check sees only the browser, never the form contents. | Not specified | SOC 2 Type II, ISO 27001 |
| PropelAuth | Sign-in, sign-up, password handling, and organization membership. | Names, email addresses, password hashes, and which organization each user belongs to. HP Solve never sees or stores your password. | United States | SOC 2 Type II |
| Inngest | Runs background jobs such as imports, exports, and scheduled maintenance checks. | Job parameters: identifiers and the settings needed to run the job. The rows themselves are read from the database while the job runs. | United States | SOC 2 Type II |
| Anthropic | Powers the optional AI form and event-type generators. | The description you type, and the name and field list of the form being extended. Never asset records, photos, or documents. Anthropic's API terms exclude customer inputs from model training. | United States | SOC 2 Type II, ISO 27001 |
| Resend | Delivers transactional email such as alarm notifications. | Recipient address and the message contents. | United States | SOC 2 Type II |
Your organization's data is isolated
Every record in HP Solve belongs to exactly one organization, and every request to the server is checked against the organization of the signed-in user before any data is read or written. The check is enforced in the server code, not by the browser, and it applies to the API as well as the screens. A user in one organization cannot see, guess at, or export another organization's data.
Sign-in and accounts
- Authentication is handled by PropelAuth, an identity provider with its own SOC 2 Type II report. Passwords are stored by PropelAuth as one-way hashes and never reach our servers.
- Access is role-based. An organization's administrators decide who can view, edit, and configure, and can remove a user at any time.
- Trial organizations are created with a single user and are never automatically joined to an existing organization by email domain, so a stranger from the same domain cannot land inside your account.
Encryption and file access
- All traffic between your browser and the service is encrypted with TLS. Plain HTTP is not served.
- Data at rest, in the database and in file storage, is encrypted by the providers that hold it.
- Attached documents, import and export files, and video are stored privately and download only through short-lived signed links issued to a signed-in user who is authorized to see them.
- Photos are stored in Cloudflare Images under random identifiers that are never listed publicly, and the application hands out only links it has signed with a short expiry.
When our staff access your data
Your data is yours. HydroPro staff do not browse customer data, and there is no routine business reason for them to open it. Access happens in three situations, and only these:
- Support you asked for. When you report a problem or ask for help, the staff member working on it looks at what is needed to help you, and nothing else.
- A problem we found. When monitoring or an error report shows a fault affecting your organization, an engineer may look at the affected records to fix it. We tell you what we found when it concerns your data.
- An emergency. When an incident threatens the service for everyone, a senior engineer may access production directly to contain it. Such access is limited to what the incident needs, and it is recorded in the incident's write-up.
In every case staff use named staff accounts, not shared credentials, and they are never added as members of your organization. Staff access to production is removed when someone leaves the company.
How we build and release
HP Solve's source code never carries customer data. This is how it is kept and released.
- The code lives in private repositories on GitHub, which maintains SOC 2 Type II reports for its cloud platform, available through its Trust Center.
- Every change runs the automated checks and test suite before it is released.
- Dependencies are kept current and updated when a vulnerability is published.
- Secrets such as database credentials and API keys are held by the hosting platform, never in the code, and are rotated when a person with access leaves.
- Development and testing use a separate database from production.
Backups and availability
The database is backed up by our database provider on a rolling schedule and can be restored from a recent backup. Uploaded files are stored redundantly by our storage provider. The application runs on a hosting platform with redundant infrastructure and automatic failover. We do not offer a service-level commitment on the free trial; availability terms for paid subscriptions are agreed in your order.
If something goes wrong
If we confirm a security incident that affects your organization's data, we notify your account owners by email promptly, and no later than 72 hours after we confirm it, with what happened, what data was involved, what we have done, and what we recommend you do. We cooperate with any notification obligations you have as a public entity.
If you believe you have found a security vulnerability in HP Solve, email support@hp-solve.com with the details. We will acknowledge the report, keep you informed, and not pursue a good-faith researcher who reports responsibly and does not access data beyond what is needed to demonstrate the issue.
Data retention and deletion
How long we keep data, when trial and cancelled data is deleted, and how to request deletion are set out in the privacy policy. The short version: trial data is deleted after a 30-day read-only period, paid data 30 days after a subscription ends, and either sooner on request.
Security questionnaires and procurement
Send vendor security questionnaires, data-handling forms, and contract security exhibits to support@hp-solve.com. We answer them in writing, and we can point you to each provider's trust page and, where the provider allows, their SOC 2 report.
