Trust & Security
ND Hub is designed to help providers manage sensitive operational and participant information responsibly. This page explains, in plain English, how access, authentication and data protection are handled within the platform.
ND Hub uses secure authentication services to verify users and manage account access. Supported sign-in methods include email & password (with password-reset by email) and Google sign-in. Users should never share passwords or authentication codes with another person.
New passwords are checked against known-compromised password databases and rejected if they appear in a public breach list.
Roles are stored separately from user profiles and evaluated on the server for every protected request. Database access rules help prevent users from accessing records outside their authorised organisation or role.
Administrative actions such as role grants and permission changes are recorded in internal audit logs for review.
Data sent between your browser and ND Hub is protected using encrypted HTTPS connections. API calls to backend services and third-party integrations are made over TLS.
ND Hub uses established cloud infrastructure and managed technology services to operate core parts of the platform, including database, authentication, storage and payments processing.
Selected platform services are powered by Supabase. Payments are processed by Stripe. These providers are named for transparency; listing them does not imply endorsement of ND Hub by those companies.
Provider organisations remain responsible for deciding what information is entered into ND Hub and who receives access to it.
Access should be limited to people who genuinely require the information for their work. Organisations should promptly remove access when a staff member or contractor no longer requires it.
Uploaded files are stored in private storage buckets that are not publicly listable. Downloads are served through short-lived signed URLs so links cannot be shared indefinitely.
The optional Document Vault applies client-side encryption to files before they are uploaded, so vault contents remain encrypted while stored.
Short answers to common questions about how ND Hub protects your information.
ND Hub supports email & password sign-in (with password reset by email) and Google sign-in. New passwords are checked against known-breach lists and rejected if compromised.
Access is governed by roles stored separately from user profiles and enforced on the server for every request. Database rules help prevent users from reading records outside their authorised organisation or role.
Yes. Traffic between your browser and ND Hub uses HTTPS, and backend/API calls to integrated services are made over TLS.
ND Hub runs on established managed cloud services. Core platform services are powered by Supabase and payments are processed by Stripe.
Files are stored in private buckets that are not publicly listable, and downloads use short-lived signed URLs. The optional Document Vault encrypts files on your device before upload.
ND Hub does not currently claim SOC 2, ISO 27001, PCI, HIPAA or GDPR certification. The platform describes the technical safeguards actually in place rather than relying on third-party badges.
Contact us immediately using the security contact on this page. Do not include participant records, passwords or authentication codes in the initial email.
The Privacy Policy describes what information is collected, how it is used, retained and disclosed.
ND Hub aims to collect and process only the information required to provide its platform functions. More detailed information about collection, use, retention and disclosure is contained in the ND Hub Privacy Policy.
If you believe an ND Hub account or information may have been accessed without permission, use the form below to reach our security contact. Do not include participant records, passwords, authentication codes or other highly sensitive information in your report.
No online platform can guarantee absolute security. ND Hub combines technical safeguards, controlled access and responsible operating practices to reduce risk. Provider organisations also need appropriate internal policies, staff training and access-management procedures.
Last reviewed: November 2026