Security

Last updated: 1 June 2026

HARRIS is operated by Horizon Frame Limited and built on Cloudflare's global edge platform. This page summarises the controls we use to protect customer data, including data we receive from Google, Meta, Shopify, and the other third-party platforms users connect to HARRIS.

1. Infrastructure

• Runtime: a single Cloudflare Worker. There are no long-running servers or SSH-accessible hosts.
• Storage: Cloudflare D1 (SQLite) for structured data, R2 for images and assets, KV for cache and configuration, and Durable Objects (SQLite-backed) for agent state and metrics.
• Transport: HTTPS-only on harrishq.ai, terminated at the Cloudflare edge. HTTP Strict Transport Security is enabled on all responses (max-age=31536000; includeSubDomains).
• Network isolation: the Worker reaches third-party APIs only over TLS, using credentials decrypted in-memory at request time.

2. Authentication and session security

• Account passwords are hashed with bcrypt; the plaintext is never stored or logged.
• Sessions are JWTs (HS256) signed with a Cloudflare secret, issued as HttpOnly; Secure; SameSite=Strict cookies. Access tokens expire after 2 hours; refresh tokens after 30 days and are path-scoped to /api/auth.
• Programmatic access uses per-user API keys passed via the X-API-Key header.
• OAuth state is signed and single-use, and OAuth callback pages are served with X-Robots-Tag: noindex.

3. Credential and secret handling

• Every per-platform credential a user connects (OAuth refresh tokens, admin API tokens, webhook signing secrets) is encrypted at rest with AES-256-GCM before being written to D1.
• The encryption key (CREDENTIAL_ENCRYPTION_KEY) is stored as a Cloudflare Worker secret, never in source control.
• Credentials are decrypted only inside the Worker, only when constructing a service instance for the active request, and never returned to clients.
• Disconnecting a platform deletes the stored ciphertext immediately and, where the provider supports it, revokes the underlying token.

4. Multi-tenant isolation

• All customer data is scoped by website_id and (where applicable) organisation_id. Every query that returns user data joins through a scoping helper that enforces the caller's accessible websites.
• There is no cross-tenant access path: a user cannot read another organisation's credentials, conversations, campaigns, costs, or webhook events.

5. Webhook verification

• Inbound webhooks (Shopify orders/create, GitHub events, Meta deauthorisation callbacks) are verified with constant-time HMAC checks against the signing secret captured at register-time, before any payload processing.
• Telegram webhooks use a per-bot header secret (X-Telegram-Bot-Api-Secret-Token) verified on every request.
• Subscription registrations and signing secrets are tracked in webhook_subscriptions; deregistration on disconnect removes them.

6. AI providers and PII handling

• Business context sent to Anthropic and OpenAI passes through a PII-stripping step that removes email addresses, phone numbers, and postal codes before transmission.
• Anthropic and OpenAI's API terms prohibit using API inputs to train their models; we rely on those contractual commitments for AI sub-processors.
• Every AI call is logged against the website with model, token counts, and USD cost — providing an auditable record of what was processed and when.

7. Response security headers

All HTTP responses include:

• Strict-Transport-Security: max-age=31536000; includeSubDomains
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy: camera=(), microphone=(self), geolocation=() — microphone is permitted only for same-origin Conductor voice input; camera and geolocation are denied.
• Public marketing pages also send a strict Content-Security-Policy that restricts scripts and connections to the same origin.

8. Action tiering

AI tool calls are governed by a tiered confirmation model. Low-risk read tools execute silently; any tool that writes to a third-party platform, sends email, posts content, merges code, or moves money requires either an interactive user approval or a pre-authorised scheduled task. Generated marketing campaigns are created in a paused state by default — they cannot spend money without explicit activation.

9. Data retention and deletion

HARRIS runs automated daily retention enforcement. The retention schedule is published in our Privacy Policy (section 6) and instructions for requesting deletion are on the Data Deletion page. Disconnecting an individual platform removes its credentials immediately; deleting an account removes all account-scoped data.

10. Vulnerability reporting

If you discover a vulnerability in HARRIS, please report it to security@harrishq.ai. We commit to acknowledging reports within two business days and to working with researchers in good faith. Please do not test against other users' data; use a HARRIS account you control.

11. Compliance and assessments

For Google's restricted Gmail scope (gmail.modify), HARRIS undergoes the CASA security assessment required by Google's API Services User Data Policy and renews it annually. Our handling of Google user data is described in section 14 of the Privacy Policy. UK GDPR data-subject requests are handled within 30 days (see Privacy Policy section 7).

12. Contact

• Security reports: security@harrishq.ai
• General support: support@harrishq.ai
• Data Protection Officer: dpo@harrishq.ai