Security
Your projects, clients and books are some of the most private things your studio has. This page explains, in plain terms, how hejmae looks after them. For what we collect and who we share it with, see the Privacy Policy.
Where your data lives
Your studio’s records and files are stored in the United States with Supabase, which encrypts them on disk. Every connection to hejmae is encrypted, and browsers are told never to connect without it.
Files stay private
Receipts, drawings, documents and photos are kept in private storage, never at a public address. Each time someone opens one, hejmae makes a link that only works for a short while.
Signing in
Sign-in is handled by Clerk, so hejmae never sees or stores your password. You can turn on two-step verification with an authenticator app, a text message or backup codes in Settings → Account.
Your team sees what you choose
Each teammate has a role, and areas like finances and team management need their own permission. Only the owner and admins can see vendors’ trade-account passwords. When you remove someone, their access ends right away.
Your clients
Clients don’t create an account. Each project’s portal is a private link plus an access code that you give them yourself; the code is never sent by email. Clients see only what you share, and you can turn a link off and issue a new one at any time.
Payments
When a client pays by card, the card details go straight to your own Stripe or Helcim account. They never pass through hejmae or get stored by us.
Passwords and connections
The keys that connect hejmae to QuickBooks, Gmail and your payment processor, vendors’ trade-account passwords and vendors’ tax IDs are encrypted again by hejmae before they’re saved, with a key kept apart from the database.
AI features
hejgent and the other AI features send our AI providers only what a task needs. They don’t train their models on it and delete it within 30 days. hejgent never emails anyone on your behalf without your approval.
Who at hejmae can see it
We don’t sell your data, use it for advertising, or use it to train AI models. Our team looks at a studio’s data only to help when you ask, to fix a problem, or when security or the law requires it. We’re alerted to errors and unusual activity so we can act quickly.
Your data is yours
The studio owner can download everything, every record and every uploaded file, from Settings → Studio data. If your plan has ended, email us and we’ll send you an export. To close your account and delete your data, email privacy@hejmae.com; the Privacy Policy explains how deletion and backups work.
Reporting a security issue
No system is perfectly secure. If you think you’ve found a security problem, email privacy@hejmae.com with the details and we’ll reply within five business days. Please don’t access other studios’ data or disrupt the service while you look.