Security

Your product data stays your product data.

Howard handles early requirements, calculations, files, test evidence, and design rationale. Security copy must therefore describe concrete controls and contractual commitments — not ask engineering teams to accept a generic trust statement.

Request access Request access

Project isolation

Projects are separated by default.

Project context is available only to authorized members of that project. The authorization model, administrator controls, and audit behavior are published here once verified; until then they are covered in the security brief rather than summarized on a marketing page.

Data lifecycle and controls

You should know where data goes and how long it stays.

This table is the whole security posture, including the parts that are not finished. A control is listed as in force only where it has been verified; everything else is named as outstanding rather than left off the page, and is answered directly in the security brief.

Control	What it covers	State
Training use	Project threads, files, revisions, inputs, and outputs are not used to train shared models.	In force
Project isolation	Project context available only to authorized members of that project.	In force
Hosting and processing regions	Where project data is stored and where it is processed.	In the brief
Encryption in transit and at rest	Transport and storage protection for project data.	In the brief
Retention and deletion	Retention defaults and what deletion actually removes.	In the brief
Backups and deletion propagation	Backup retention, and how a deletion reaches backups.	In the brief
Subprocessors and model providers	Who processes project data, and whether providers hold zero-retention terms.	In the brief
Staff access and support-access logging	Which staff can reach project data, and what is logged when they do.	In the brief
SSO and role-based access	Enterprise identity and permission control.	Not yet published
Audit logs, IP restrictions, legal hold	Administrative visibility and access constraints.	Not yet published
Data export	Getting project work back out in a usable form.	Not yet published
Independent testing	External verification of the controls above.	Not yet published

Howard does not borrow another vendor’s claims, certifications, or terminology. A control appears on this page as in force only when Howard has the audited control itself.

Enterprise controls

Publish controls when they exist.

SSO, role-based access, audit logs, IP restrictions, data export, legal hold, and independent testing belong on this page only after implementation and verification. Until then, the answer is a concise security brief and a direct technical contact — not a roadmap presented as a control.

Request access

Incident handling

Make the response path explicit.

A security response path is only useful if it is written down before it is needed. The security contact, reporting channel, acknowledgement target, incident-notification commitment, and public status location are stated in the security brief and confirmed at the point of access.