The RFP asks for specific safeguards, and the NDA restricts AI. HSG accepts Section 3.10 and the NDA without exception. This page lists each requirement and how we meet it.
| Requirement (RFP 3.10 / NDA) | How HSG meets it |
|---|---|
| NDA before non-public information | Signed before any District data is sent. Until then the study works from published documents only, as this portal does. |
| Use limited to the study; need-to-know access | Only the six named team members receive access, each by individual account and role. No other HSG staff, no other client work. |
| Encryption at rest and in transit | Platform traffic uses TLS. The platform database and file storage are encrypted at rest by the hosting providers. Files exchanged outside the platform travel by a District-approved secure method. |
| No personal email or consumer file sharing | Team members use HSG-managed accounts for all District work. No District file goes to a personal mailbox or a consumer sharing service. |
| Endpoint protection, updates, access control, MFA | Team devices run current operating systems with endpoint protection and automatic updates. HSG accounts that hold or receive District information require multi-factor authentication. Platform sign-in uses single-use, expiring links sent to those accounts. |
| Separation from other clients | Every platform table carries a workspace key enforced by database row-level security. One authorization gate checks role and workspace on every request, and reads of sensitive records are logged. |
| 24-hour incident notice | Any suspected or confirmed incident involving District information is reported to the District's project lead within 24 hours of discovery, with the facts known at the time and the steps taken. HSG cooperates in the investigation. |
| Subcontractors | HSG proposes no subcontractors. Any future addition needs the District's written approval and signs equivalent terms. |
| Generative AI | No District Confidential Information goes to any generative AI service, public or commercial, unless the District approves in writing first. District information is never used to train any AI model. The platform's market statistics, structures, compaction and costing are deterministic calculations and run without AI. HSG uses AI only on public material (for example, peer agencies' published salary schedules) unless the District authorizes more, and every AI call in the platform is metered and logged by purpose and user. |
| Individual responses protected | Questionnaire and interview responses are not attributed to individuals in reports or presentations. Supervisors do not see their staff's individual responses. |
| Return or destruction | At completion, all District information is returned or destroyed within 30 days, as the District directs, and HSG certifies destruction in writing. Final deliverables in Word and Excel stay with the District. |
| Law and records | HSG complies with applicable federal and California privacy, breach-notification and records laws, and recognizes that the District's records are subject to the California Public Records Act. |
We do not claim certifications we do not hold. HSG is a small firm, and the controls above are the ones we operate today or commit to in the contract. Where a control depends on a provider (encryption at rest), we say so.