Trust.

• There are no passwords to steal. People sign in with a one-time email code, Google or Apple.
• Access in Portal is role-based and scoped to each agency.
• hub.inc, ph.app, Portal and our API accept only TLS 1.2 or newer, and our websites tell browsers to always use HTTPS.
• A web application firewall and rate limits protect our API.
• Our production database has no public internet address.
• Our production database is backed up daily and backups are kept for 35 days, with point-in-time recovery for the last 7 days.
• Staff actions that change data are recorded in an audit log that does not store personal details such as email or phone.

• PHapp and Portal carry no ads, sell no data and contain no third-party advertising or tracking.
• Anyone can read alerts without an account.
• Residents can delete their data themselves from PHapp's settings, at any time.
• Agencies see counts of reads and shares, never which resident read what.
• Our servers and database run on Google Cloud in the United States.
• Support messages are never used to train AI models.
• hub.inc uses self-hosted analytics and loads no third-party trackers.

The details are in our Privacy Policy and Terms of Service.

We build to WCAG 2.1 AA as our accessibility standard, and check it as we build. We have not yet published a formal conformance report. Ask us and we'll tell you where we stand.

• Hub Public Benefit Corp. is a Delaware public benefit corporation.
• Our directors must balance stockholders' financial interests, the interests of people materially affected by our conduct, and our public benefit purpose.

Read our charter purpose on the About page.