Security overview

A plain-language overview of how Harold approaches security as a product discipline. This is not a substitute for your organisation’s formal assurance pack.

Harold is engineered for institutional expectations: access control, encryption in transit, and operational practices that reduce accidental exposure. Formal assurance packs are shared through procurement — not inferred from public pages.

Security posture

Controls-first

Product decisions default to safer paths: least privilege patterns, explicit approvals for sensitive changes, and clear separation between configuration and day-to-day work.

Data handling

Minimisation and purpose limitation are part of the design mindset — not an afterthought.

Identity

Workspace membership and sign-in integrate with modern enterprise identity practices.

Encryption in transit (TLS)Workspace permissionsOperational logging

Shared responsibility

Harold

Protects the service boundary.
Ships security fixes and communicates impact.
Supports customer assurance reviews.

Your organisation

Controls devices, credentials, and offboarding.
Defines acceptable data classes for prompts and exports.
Runs incident response when user behaviour is involved.

Assurance & reviews

Data handling Contact

Was this page helpful?