- Who can see our assessment data?
- Assessment records are readable only by the account that created them and by named First Hour staff roles. Access control is enforced by database row-level security and verified server-side, not in the browser.
- Can a user alter their own readiness score?
- No. Scores are computed server-side and written by a database trigger. Score fields submitted from a client are ignored.
- Where is data hosted?
- Data is held in a managed Postgres environment with encryption in transit and at rest. Specific region details are provided in the security overview supplied on request.
- What personal data is collected?
- Business contact details (name, work email, organization, role, industry, region), assessment responses, and consent records. We do not request special-category personal data and ask clients not to submit confidential incident detail into free-text fields.
- How long is data retained?
- Assessment and report records are retained for the life of the account, then deleted on request. Deletion and export are self-service from the data and consent centre.
- Do you use our data to train AI models?
- No. Report generation calls a hosted model provider to produce narrative text for your report. Your content is not used to train First Hour models, and aggregate benchmarking only uses de-identified data where consent has been recorded.
- Are you certified to SOC 2 / ISO 27001?
- No. First Hour holds no independent security certification today, and we will not claim one. The security overview describes implemented controls factually so your team can assess them.
- What is your incident response commitment?
- Documented internal process with triage, containment, and customer notification. Contractual notification timelines are set in the DPA, which requires final legal approval before signature.
- Is there an SLA?
- An availability and support SLA is drafted for enterprise agreements but is not yet counsel-approved, so no availability percentage should be treated as contractually binding today.
- How is the methodology versioned?
- Each completed assessment stores its methodology version (currently FH-ACTIVE-1.0). Scoring changes ship as a new version so historical results never change retroactively.
Final legal version required
Terms of service, DPA, MSA and SLA drafts are available for review but must be finalised by counsel before execution.
No certification claims
First Hour is not independently certified or audited. Nothing on this site should be read as a certification, attestation or regulatory compliance guarantee.