How headoffis handles your data

headoffis is a QuokkaQuery product. The business workspace currently runs locally on the computer that starts it. Public cloud access to business workspaces is not open.

Where workspace data lives

Business records and sign-in accounts are saved in local Firebase services on that computer. The app connects through a server on the same computer; signing in on another device does not by itself make this local workspace available there.

Access controls protect data through the app. They do not prevent someone who can read the computer's saved files from copying them. Protect the computer, its user account, and any exported files.

Accounts and access

Each person uses their own email and password. The server checks current business membership, role permissions, and relevant assignments before returning records or accepting a change. Selecting a business in the browser does not grant access to it.

App sessions use HttpOnly cookies, which page scripts cannot read. Sign out on shared computers. Deactivate or remove people who no longer need access, and use a strong password that you do not reuse elsewhere. See account and password help.

Exports, backups, and recovery

Owners can download a business ZIP from Settings, including while billing makes the business read-only. It includes business records, all retained workspace history, and conversations the exporting owner participates in. Other people's private conversations, passwords, and payment card details are excluded.

Business ZIP exports and portable workspace JSON files are readable, unencrypted files. A portable workspace export covers fewer records than the owner's business export. Store copies securely and check which export you need in the export guide.

The local Stop and save command exports saved accounts and data for the next local start and keeps the previous export. It is not an off-device backup. An unexpected shutdown can lose changes since the last export, and a failed save-and-stop operation leaves the local data service running so the export can be retried.

Self-service restore is not available. A downloaded export does not provide an automatic recovery service, and we do not promise recovery of deleted data. Keep a separate copy before major changes or deletion.

History and deletion

Logs keeps recorded workspace changes, including older entries in paged history. It is not a complete or tamper-proof audit record. Work, people, messages, and calendars have separate records, and internal recovery can change operational history.

Owners can permanently delete a business from Account after reviewing the confirmation. Leaving a business, deleting a personal account, and canceling a subscription are separate actions. Existing downloaded files and saved local backups are not erased by an in-app deletion. See cancellation and deletion help.

Payments, email, and website analytics

When configured, the local app uses Stripe's test environment for billing. Payment details are entered on Stripe-hosted pages; the workspace stores billing references and status, not card numbers. Live billing is not enabled.

Account and workflow emails are captured in a local outbox for inspection. A captured email has not been sent or delivered, and live email and SMS delivery are not enabled. In-app notifications can still be shown.

The hosted public website uses Ahrefs Web Analytics. The workspace and sign-in screens do not load that analytics script. The website privacy policy explains public-site data handling.

Report a security issue

Email support@headoffis.com with the affected page, what happened, and steps to reproduce it. Use sample data and leave passwords, tokens, and real customer records out of the report.