Security

Last updated: 2026-10-01

HardTally records which AI-driven changes delivered a measured result. That record is only useful if it can be trusted, so the product is deliberately narrow: it keeps what a measured comparison needs, and little else.

Where data lives

HardTally is built EU-first. The processing and storage posture, the data processing agreement (DPA), the subprocessor list and the retention policy are documented and published on this page before the first paid pilot.

How the product is designed

• Each company’s workspace is kept separate from every other company’s.
• Sensitive discovery files and raw survey answers stay with the department that owns them. The company portfolio shows initiatives, owners, stages and published results.
• Corrections create a new version instead of overwriting the old one, and weekly digests flag results that were corrected later.
• The person accountable for the metric confirms each result before it can be shown as verified. Owners don’t need an account.

This website

This website is a set of static pages served over HTTPS. It sets no cookies and has no analytics, third-party scripts or forms. The privacy notice explains the little data it handles.

Reporting a security issue

If you believe you have found a vulnerability in hardtally.com or the HardTally product, write to [email protected]. Please include enough detail for us to reproduce the issue, and don’t access, change or delete data that isn’t yours.

We acknowledge reports within 3 business days and keep you informed while we fix the issue.

Security and procurement questions

For security questionnaires or procurement questions, write to [email protected].