One client can never see another
Each client workspace is isolated from every other, and that isolation is enforced on the server on every request rather than by hiding things in the interface. It is covered by an automated test suite that runs against the real HTTP stack.
Two-factor authentication is mandatory for staff
Anyone holding a staff role at an agency must use TOTP two-factor authentication. It is not a setting an administrator can relax, and it cannot be switched off while a staff membership exists. A teammate who loses their phone signs in with a single-use recovery code; if those are lost too, an agency admin can reset their 2FA, which signs them out everywhere and makes them set it up again before they can reach anything.
Signup is invite-only, and self-signups wait for a human
Nobody joins an agency by finding the address. Staff arrive on a signed, expiring invite; anyone who signs themselves up lands in an approval queue an administrator has to clear before the account can do anything.
File access is checked, not guessed
Every download is authorised against workspace membership at the moment it is requested. There are no unguessable links standing in for permission, so a URL that leaks is not a door. Files that staff mark internal are never served to a client account.
Passwords are stored only as hashes
Passwords are hashed with scrypt and never stored or logged in a form anyone here can read back, including us. Card details never reach our servers at all: payment is handled entirely by Stripe's hosted checkout and billing portal.
An assistant gets your permissions and nothing more
A personal API token acts as you, with exactly your access. Every tool a connected AI assistant calls runs through the same API the app itself uses, so permissions, audit events and notifications behave identically to you clicking the button. There is no second way in to keep in step.
Sign-off is a record, not a chat message
Approvals are written to an append-only decision log naming who approved which version of what, and when. Feedback is pinned to the artwork it refers to and carried across revisions, so the history of a decision survives the next round.
Your billing is your business
If an agency's subscription lapses the portal becomes read-only rather than disappearing, and the message a client sees never mentions billing. An unpaid invoice is between us and the agency, and is never disclosed to that agency's clients.
Your data leaves when you ask it to
A full export of the account is available on demand, and closing the account removes it. An expired trial goes read-only rather than being deleted, so nothing is lost while a decision is being made.
Who else touches your data
The full list, not the flattering half of it. We give reasonable notice before adding or replacing any of them, and you may object on data protection grounds.
| Who | What they do | Where |
|---|---|---|
| Replit | Application hosting and uploaded file storage | United States |
| Neon | Managed PostgreSQL database | Depends on the deployment region |
| Stripe | Payment processing and subscription billing | United States and Ireland |
| Resend | Transactional email (invitations, password resets, notifications) | United States |
| Anthropic | Optional AI features: drafting a ticket from pasted text, and thread summaries. Only the text you submit to those features is sent. | United States |
What we cannot claim
We do not hold SOC 2 or ISO 27001. HoopoeHQ is a young product and those audits are a matter of time and money rather than a claim we can make today, so we would rather list what the software actually does and let you check it. If your procurement process requires a certification we do not have, tell us early and we will say plainly whether we can meet it.
Put one client behind it and see.
Your branding from day one, and your clients never pay for a seat.
14-day free trial. No card. Your clients are always free.
