AI, Security and Privacy in Hillscom HCM

Private by default

Your answers belong to your organisation. When you use HCM on your own, Hillscom’s administrators can see your account details, progress and scores, but not what you wrote. If you choose to share your answers, or your organisation starts working with us, the Hillscom people assigned to you see them at the level agreed with your organisation. You can stop sharing at any time.

The right access for each person. Your client admin invites colleagues with edit, comment or view access, so a director can follow progress without being able to change an answer, and a process owner can contribute to the questions they know best. When we work with you, each tool can be kept to Hillscom only or opened to your team, so work in progress is shared when it is ready.

Every change has a name and a date. Each answer, description and action shows when it was last updated and by whom. Documents carry an issue history and a record of who approved each issue. That is good practice for any management system, and it means you never have to wonder how a piece of text got there.

AI help, with a person in charge

Only with your agreement. AI help in HCM is switched on for each organisation, and only with that organisation’s agreement. You can ask us at any time not to use it for your organisation.

Your own AI assistant. If your organisation switches AI access on, people with edit access can connect their own AI assistant, such as Claude or Microsoft Copilot, to their gap analyses. It reads the questions, guidance, answers and evidence descriptions and suggests wording for how your process meets a requirement, what is missing, or the action to close it.

Hillscom’s own AI assistant. On an engagement, your Hillscom consultant may use our own AI assistant to help draft your management system documents. It reads only the organisation profile, our working copy of your gap analysis, the documents we generate for you and the documents you have marked as available to it.

Suggestions, never decisions. Whichever assistant is used, it can only suggest. A person reviews every suggestion and nothing changes until they accept it. AI cannot set or change a rating: whether a requirement is met, partly met or a gap is always your organisation’s own judgement. Suggested text is marked as AI-assisted until a person accepts it, and HCM records what the AI read, what it suggested and who accepted it.

We think this is the right balance. AI is very good at turning a page of notes into clear procedure wording, and it saves real time on documentation. It is not accountable for your management system, and an auditor will not accept “the software wrote it” as evidence of anything. Keeping a named person responsible for every word is what makes AI help safe to use. Our AI-assisted delivery page explains how we use AI across our consultancy work.

Security built in

Protected sign-in. Every account confirms its email address and is approved before use. Repeated failed sign-in attempts lock the account for a period, password reset links are single use and expire after an hour, and passwords are only ever stored as a one-way hash.

Organisations kept apart. Every request is checked against the organisation and role of the person making it, so one client can never see another’s information. The application runs over HTTPS with a strict content security policy, and its files and backups are kept outside the public web folder.

No advertising, no trackers. HCM sets one strictly necessary cookie to keep you signed in. It has no analytics or advertising cookies, and we never sell personal data.

Your data when you leave

You can download your answers and actions at any time. When a paid account is closed at the client’s request, the organisation receives an export of its information and the account stays available read only for 90 days before it is deleted. Information is never held back as a penalty for leaving.

The full detail is in our privacy policy and in the privacy notice inside HCM. See how drafts are reviewed and approved in the client hub, or get in touch if your organisation needs answers to a security questionnaire before using HCM.