Security & Trust Center

Security & Compliance

What we do to protect your data, and what we haven't done yet. We'd rather show you the gaps than hide them behind checkmarks.

Honest status, updated October 27, 2026
  • In place: HTTPS everywhere (TLS 1.3, HSTS), bcrypt password hashing, login lockout after 5 failed tries, rate limits, Cloudflare firewall and tunnel with no open server ports, SSH keys only, server firewall and brute-force blocking, audit logging.
  • Not yet: multi-factor login, encryption at rest for the server disk and databases, automated off-site backups, outside audits or certifications.
  • Working toward: HIPAA, GDPR and CCPA compliance, and a SOC 2 audit targeted for Q2 2027.
Certification & Status
Where we actually stand. Nothing here is certified by an outside auditor yet.
🛡️
SOC 2 Type II
⏳ In Progress — Q2 2027
🏥
HIPAA
⏳ Working toward compliance
📋
ISO 27001
⏳ Some controls in place · not certified
🇪🇺
GDPR
⏳ Working toward · data requests honored
🇺🇸
CCPA
⏳ Working toward · we don't sell personal data
🔒
TLS 1.3
✓ Active
Technical Controls
Security measures implemented in production infrastructure
🔐

Encryption

All data in transit protected by TLS 1.3 with HSTS preload enabled. Connected social media account tokens are encrypted with AES-256. Full disk and database encryption at rest is not in place yet; it is on our roadmap. Passwords hashed using bcrypt — never stored in plaintext.

🔑

Authentication Security

bcrypt password hashing with adaptive cost factor. Secure session management with httpOnly + SameSite cookies. Account lockout after 5 failed attempts (15-min cooldown). Rate limiting on all auth endpoints.

🧱

HTTP Security Headers

Full header suite enforced: Content-Security-Policy, X-Frame-Options: DENY, Strict-Transport-Security, Referrer-Policy: strict-origin, Permissions-Policy, X-Content-Type-Options: nosniff.

📝

Audit Logging

All authentication events, data access, administrative actions, and security-relevant operations are logged with IP address, timestamp, user identity, and action taken. Logs are kept and are not automatically deleted.

⚡

Rate Limiting

Strict rate limits enforced at the API layer: 10 requests / 15 minutes on authentication endpoints, 5 requests / hour on password reset flows. Cloudflare WAF provides additional protection.

🗂️

Data Isolation

Requests are tied to the signed-in user, and each account's data is kept separate. One exception we know about and are fixing: in Market Master, the business profile used to write marketing copy is currently shared across accounts.

Compliance Framework
How we map to major regulatory frameworks
📊

SOC 2 Trust Criteria

  • Security: Access controls, encryption, monitoring
  • Availability: written incident response plan; no uptime guarantee yet
  • Confidentiality: Data classification, access restrictions
  • Formal audit targeting Q2 2027
🏥

HIPAA Safeguards

  • Technical: Unique user ID, audit controls, TLS 1.3, integrity controls
  • Administrative: written security policies; formal risk analysis not done yet
  • Physical: Datacenter controls, Cloudflare Tunnel
  • Working toward HIPAA compliance. Please don't store patient health information in our products yet. Ask us before signing a BAA.
🌐

ISO 27001

  • In place: access controls, password hashing, firewall, SSH keys only, audit logging, written incident process
  • Not yet: multi-factor login, encryption at rest everywhere, automated backups
  • Not certified. No ISO audit scheduled yet.
Our Policies
Formal documentation governing how we protect your data
📄 Information Security Policy 🚨 Incident Response Plan 🔑 Access Control Policy 🗃️ Data Retention Policy 🏥 HIPAA Compliance Overview 🇪🇺 Data Processing Agreement
Responsible Disclosure
We take security reports seriously and act quickly
🔍

Report a Vulnerability

If you discover a security vulnerability in our systems, please report it responsibly. We commit to acknowledging all reports within 48 hours and providing a resolution timeline within 7 business days.

Email: [email protected]

PGP key: Coming soon

📅

Disclosure Policy

  • 90-day window: We request 90 days to investigate and remediate before public disclosure
  • Good faith: We will not pursue legal action against researchers acting in good faith
  • Scope: hypernovaaiinc.com and all Hypernova AI products
  • Out of scope: Social engineering, physical attacks, DDoS
Vendor Security
Every outside company our products send data to, what for, and where they're based. Each provider's own terms govern what it does with that data, and some providers' terms allow them to keep or use it. Follow the links to read them.
CompanyWhat we use it forBased inTheir terms
IONOSServer hosting (our main server)Germany (company), U.S. serverPrivacy
CloudflareWebsite security, firewall, secure tunnel, some AIUnited StatesPrivacy
StripePayments. Card numbers never touch our servers.United StatesPrivacy
SupabaseAccounts and data for BusinessBuilder AIUnited StatesPrivacy
ResendSending emailUnited StatesPrivacy
GoogleSign in with Google, Gemini AIUnited StatesPrivacy
AnthropicAI (Claude)United StatesPrivacy
OpenRouterAI routing to several model makersUnited StatesPrivacy
GroqAIUnited StatesPrivacy
CerebrasAIUnited StatesPrivacy
SambaNovaAIUnited StatesPrivacy
Together AIAIUnited StatesPrivacy
Mistral AIAIFrancePrivacy
DeepSeekAIChinaPrivacy
Alibaba Cloud (DashScope)AI for images and video in Market MasterChina / SingaporePrivacy
Hugging FaceAI modelsUnited StatesPrivacy
ReplicateAI models for NovexUnited StatesPrivacy
ElevenLabsAI voiceUnited StatesPrivacy
TavilyWeb search for Nova answersUnited StatesPrivacy

Security Questions?

Questions from customers, auditors and researchers go straight to the founder.

[email protected]
General Contact Data Processing Agreement