Information Security Policy

1. Purpose & Scope

This policy establishes the information security requirements for Hypernova AI Inc. It applies to all information assets, systems, personnel, contractors, and third parties that process, store, or transmit Hypernova AI data.

The objective is to protect the confidentiality, integrity, and availability (CIA) of information assets and ensure compliance with applicable laws and regulations including GDPR, CCPA, and HIPAA where applicable.

2. Information Classification

All data processed by Hypernova AI is classified into one of four tiers:

3. Access Control

Principle of Least Privilege

All access to systems, data, and infrastructure is granted based on the minimum permissions required to perform a role. Access is explicitly granted — not implicitly inherited.

Requirements

• Multi-factor authentication (MFA) is strongly encouraged for all accounts and required for privileged/admin access
• Unique identifiers required for every user — shared accounts are prohibited
• Access rights reviewed at least quarterly
• Access is revoked within 24 hours of role change or termination
• Privileged (admin/founder) access is restricted to named individuals and audit logged

4. Cryptography

• In Transit: TLS 1.3 required for all data in transit. Older protocols (TLS 1.0, TLS 1.1, SSLv3) disabled. HSTS preloading enabled.
• At Rest: Planned. Today only connected social account tokens are encrypted at rest with AES-256
• Passwords: All passwords hashed using bcrypt with a minimum cost factor of 12. Plaintext storage is strictly prohibited.
• API Keys: Stored as hashed values or in environment-encrypted secret stores, never in source code or logs
• Key Management: Encryption keys rotated at least annually or upon suspected compromise

5. Network Security

• HTTPS enforced on all endpoints — HTTP connections redirected to HTTPS
• HSTS (Strict-Transport-Security) with max-age=31536000; includeSubDomains; preload
• Cloudflare WAF deployed in front of all production systems — filters OWASP Top 10 attacks
• Cloudflare Tunnel used — no open ports on origin server, eliminating surface attack area
• Security headers enforced: Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy
• All API endpoints protected by rate limiting and authentication

6. Vulnerability Management

• Critical vulnerabilities: Patched within 30 days of identification
• High/Medium vulnerabilities: Patched within 90 days
• Low vulnerabilities: Addressed in regular maintenance cycles
• Dependency scanning performed on all software dependencies (npm audit, OWASP checks)
• Security advisories monitored via GitHub Dependabot and vendor notification lists
• Penetration testing planned annually once SOC 2 audit process begins (Q2 2027)

7. Incident Management

All security incidents must be reported to the Security Officer (CEO, Cale McMillin) immediately upon detection. The full incident response process is documented in the Incident Response Plan.

All security incidents are logged, triaged by severity, contained, remediated, and reviewed per the documented process. Regulatory notification timelines (72 hours GDPR, 60 days HIPAA) are strictly observed.

8. Third-Party Management

• All vendors with access to Confidential or Restricted data must complete a security review prior to engagement
• Data Processing Agreements (DPAs) are required for all vendors processing personal data
• Vendor security posture reviewed annually or upon significant change
• Current vendors: see the full list on our Security page, with what each one is used for and links to its terms.

9. Compliance

• GDPR: Data subject rights, lawful basis for processing, DPA maintenance
• CCPA: Consumer rights, data disclosure, opt-out mechanisms
• HIPAA: Technical, administrative, and physical safeguards per HIPAA policy
• SOC 2: Trust Services Criteria controls implemented; formal audit targeting Q2 2027
• This policy reviewed and updated annually or upon material changes to business operations

Document Control