Security and procurement
Most security pages are written to end a conversation. This one is written to start one accurately: the access model and record-handling we can describe, the subprocessors we have verified, and the things a larger buyer expects that HempDash does not have yet.
Security record reviewed August 17, 2026
Read this first
These are the questions an enterprise security review asks first. Each answer below is no. They are listed here rather than left for a questionnaire, because finding them later is worse than reading them now.
Enforcement
Each statement below renders only while the evidence behind it is current. Where you see a narrower sentence than you expected, that is the gate working, not the capability being coy.
How a statement earns its place here is set out in the Trust Center.
Public record
These are the providers that process data from gethempdash.com on our behalf. Each is bound to use it only to provide their service to us. This list covers the public website; it is not the platform list.
| Provider | What it processes |
|---|---|
| Netlify | Hosting and content delivery, and the store that holds first-party site usage events. Processes IP addresses as an inherent part of serving requests. |
| Railway | Hosts the scheduling system used to book a working session, and the internal messaging system that receives signups and applications. |
| Sanity | Content management for Academy and article pages. Some lesson media is delivered from Sanity's network directly to the browser. |
| OpenRouter | Primary AI provider for the free COA check. Receives text extracted from an uploaded document, solely to locate the fields the check reads. |
| Anthropic | Fallback AI provider for the free COA check, for the same field-location purpose when the primary is unavailable. |
| Google Analytics receives a server-sent mirror of part of the first-party usage measurement. No tag runs in the browser and no cookie or persistent identifier is involved. |
The vendor platform uses a different and larger set of providers than this website. That list is not published yet, because it has not been verified to the standard this page holds itself to, and a plausible-looking list is worse than none. It is available to customers and to prospects in procurement on request.
A document uploaded to the public check is processed in memory and is not written to a database, to file storage, or to temporary files. Extracted text goes to an AI provider solely to locate fields. Logs carry the request size and outcome, never document content.
Usage events are recorded to our own store, which is the system of record. The Site sets no cookies and runs no analytics script in your browser. What is mirrored to Google Analytics, and how, is set out in the Privacy Policy.
Compliance events are written as records rather than edited in place, so the history of a decision survives the decision changing. This is a design property of the record store, not a certification.
The full data terms are in the Privacy Policy and Cookie Policy.
Procurement
If you are running a vendor review, these are the routes that exist today. Where something does not exist, the answer above says so rather than routing you into a queue.
Security review is cheaper before a pilot than after one. If something here rules HempDash out for you, that is a useful outcome and worth five minutes.