Built to be trusted with sensitive moments.
People bring HMNPROOF their hardest evidence — deepfakes, slander, harassment, reputation attacks. This page describes the security controls we have in place to protect that data and the integrity of every scan.
This page is maintained by HMNPROOF and is not an independent certification. We describe controls that are active in the app today, not aspirational goals.
Account protection
Two-factor authentication
Every account can enable TOTP-based 2FA from the dashboard. Once enabled, sign-in requires a code from your authenticator app in addition to your password.
Leaked password protection
New and changed passwords are checked against the public Have I Been Pwned database. Compromised passwords are rejected before they can be used.
OAuth sign-in
Sign in with Google so your password never touches our servers. Sessions use signed JWTs and rotate automatically.
Least-privilege roles
Admin and moderator roles are stored in a dedicated table and checked with a security-definer function — they cannot be self-granted from the client.
Data protection
Row-level security on every table
All user data tables enforce row-level security. You can only read or modify your own records; server functions act with your identity, not a service account.
Encryption in transit
All connections use TLS 1.2+. Uploads are sent directly to a private storage bucket; nothing is served publicly.
Secrets stay server-side
API keys, service-role credentials, and AI provider keys are kept as server runtime secrets. They are never shipped to the browser or exposed in client bundles.
Input validation everywhere
Every server function validates input with strict schemas (Zod) before it reaches the database or any external service.
Integrity & oversight
Audit logging
Sensitive admin actions — role changes, plan changes, deletions — and security events like enabling or removing 2FA are recorded to an append-only audit log.
Your activity, visible to you
You can review recent security-sensitive activity on your own account from the Security tab in your dashboard.
Probabilistic, never absolute
Results are presented as probabilistic risk, not legal proof. We surface confidence and reasoning so humans stay in the loop on consequential decisions.
Responsible disclosure
Found a security issue? Email security@hmnproof.com. We respond to credible reports quickly and will not pursue good-faith researchers.