Security

Last reviewed: 2026-10-15

Security at a glance

Hortis keeps your collection data in your own region, encrypted in transit, securely stored using multiple strategies, and tracked change by change.

Hosted in your region. Your collection data is stored on Google Cloud in the US, UK, EU or Australia, depending on where you are.
Encrypted connections. Every connection to Hortis uses HTTPS with industry-standard TLS.
Multiple backup layers. Continuous recovery complemented with daily backups stored in a separate location.
Every change is recorded. Collection data is never silently overwritten. Each revision is kept, so you can see what changed.
Flexible, secure sign-in. Use single sign-on with Google or Microsoft, or built-in login with enforced password rules.
Privacy-minded. We follow GDPR principles, and all relevant staff are trained.

The sections below give the technical detail for IT and security teams.

Your collection data is stored in the region you choose: the US, UK, EU or Australia. Backups are held in the same geographic area, with one difference for UK customers, described below. Hortis runs on Google Cloud Platform (GCP), and each region has its own database service.

Regional storage. Collection data is stored in the region assigned to your organisation. Backups are held in the same area, except for UK customers, whose backups are stored in the EU.
Private network. The database runs in a Virtual Private Cloud (VPC), a private network with software-defined networking and firewall protection. It is not directly reachable from the public internet.
Hardware resilience. Data is held on a distributed, replicated file system, so a single hardware failure does not interrupt the service or lose data.
Separation between customers. All API endpoints can only access data related to the customer associated with the OAuth access token.
Supporting services. Some supporting services, such as network delivery, image delivery, email and usage monitoring, are operated by third-party providers and may process limited data outside your region, for example, while serving pages and images or sending emails. These providers are listed under Compliance and certifications.

Protecting and recovering your data

Your data is protected against three risks: hardware failure, mistakes by users, and disasters.

Encryption. Data is encrypted in transit with TLS 1.2 or higher. Data and backups are encrypted at rest with AES-256 using Google-managed keys.

Protection from user error. Hortis stores every revision of your collection data in an immutable structure. Changes are tracked rather than overwritten, so you can see what changed and recover earlier values.

Backups. We apply several backup strategies to complement the platform's built-in hardware resilience.

Point-in-time recovery (continuous backup). We can restore data to any moment in the last 7 days.
Daily backups. Automated and archived within Google Cloud.
Geo-redundancy. Backups are stored in a physically separate data center from the live database, so a site-level failure cannot affect both copies.

For more on our infrastructure provider, see Google Cloud security and Cloud SQL.

Sign-in and access control

Hortis uses OAuth 2.0, the industry-standard protocol for authentication and access control, and supports single sign-on so your institution can keep control of who has access.

Single sign-on (SSO). Users can sign in with Google or Microsoft accounts.
Built-in login. When users sign in with a Hortis password, we enforce strong passwords following OWASP password recommendations. Authentication is provided by Auth0; see also Auth0's security practices.
Multi-factor authentication. MFA is available when signing in through SSO, using your identity provider’s own policies. It isn’t currently available for Hortis password logins.
Roles and permissions. Each user is assigned a role (e.g. Admin, Editor, etc.) that controls what can be viewed and changed.
Activity log. Hortis records every revision to collection data, with record-level change history showing who made each change and when.
Soft delete. Plant collection data cannot be permanently deleted by users, but is instead archived, which can be restored at a later point if necessary.
Removing access. Administrators can remove and add users, with immediate effect.

Application and API security

All traffic between your browser and Hortis is encrypted, and the application is built to resist common web attacks.

Encryption in transit. Every connection uses HTTPS with industry-standard Transport Layer Security (TLS 1.2 or higher).
Protection against cross-site scripting. The web app uses Content Security Policies (CSP) to block injected scripts.
Protected API. API endpoints require OAuth access tokens, so only authorised users and applications can read or change data.
Secure development. Our developers follow secure coding guidelines based on OWASP Secure Coding Practices. Our build pipeline automatically scans our code for security vulnerabilities (static application security testing) and checks third-party libraries for known vulnerabilities (software composition analysis). Services run with least privilege and are deployed as fresh, immutable instances rather than modified in place, and third-party libraries are patched on a regular cycle.

How we operate

Security also depends on how our team works day to day.

Staff access to customer data. Staff do not have access to customer data unless this is required to perform a specific time-limited task.
Staff training. Relevant staff receive GDPR and security awareness training.
Incident response. Incidents are detected via our monitoring systems or through feedback from users. Affected users are informed within 72 hours of confirming a breach affecting their data.
Availability and status. Our service commitments are set out in the Service Level Agreement.

Privacy, GDPR and your data

You own your data. We are committed to the principles of the General Data Protection Regulation (GDPR), and all relevant staff are trained in them. Our Privacy Policy explains what personal data we handle and why.

Compliance and certifications

Hortis relies on a number of trusted infrastructure providers. Their independent certifications are listed below. They apply to those providers, not to Hortis itself.

Hortis (our application and operations): Hortis is not yet independently certified. Our controls are designed to align with the SOC 2 Trust Services Criteria and are described on this page.
Google Cloud (cloud provider): ISO 27001, SOC 1/2/3
Auth0 (authentication provider): ISO 27001/27017/27018, SOC 2 Type II
Cloudflare (Edge CDN and DNS): ISO 27001, SOC 2 Type II, SOC 3
PostHog (Monitoring): SOC 2 Type II
SendGrid (Email delivery): ISO 27001/27017/27018, SOC 2 Type II
Vercel (Frontend Deployment and CDN): ISO 27001, SOC 2 Type II
TwicPics, provided by Frontify (Image transformation and CDN): ISO 27001, SOC 2 Type II

For security questionnaires and the compliance documents above, see the contact details below.

Security questions and reporting a concern

If your institution needs more detail or you would like to report a concern, please get in touch.