Our own security posture.
How we secure the crawler fleet, the data it produces, and the customer dashboards. SOC2 Type II, ISO 27001, GDPR-ready.
Architectural pillars
Tenant isolation
Every customer's scan data, allow-lists, and forensic artifacts are stored in logically isolated namespaces with row-level security enforced at the database layer. Cross-tenant access is impossible by construction.
Encryption everywhere
TLS 1.3 in transit. AES-256 at rest. Per-tenant keys for forensic archives (HAR, screenshots) managed via a hardware-backed KMS. Backups are encrypted with separate keys.
Least privilege
Production access is gated by short-lived SSO + hardware MFA. Engineers receive time-bound, audited access only when responding to a documented incident or change request.
Containerized scanners
Each Chromium scan runs in an ephemeral, single-use container with no persistent state, no outbound access except to the target site, and is destroyed within 30 seconds of completion.
Continuous monitoring
All control-plane events stream into an internal SIEM with automated detection rules for credential abuse, privilege escalation, and unusual data access patterns.
Secure SDLC
Mandatory code review, dependency scanning (Snyk + npm audit + Dependabot), SAST on every PR, and signed container images with SLSA-aligned provenance for every release.
Compliance posture
Annually audited. Latest report available under NDA from security@domain-exploits.io.
Information security management system aligned. Statement of Applicability available on request.
EU data residency option. We are a processor under Article 28; DPA available pre-contract.
Customer-side controls help merchants satisfy requirements 6.4.3 and 11.6.1 (script integrity on payment pages).
Detect unauthorized data egress paths. BAA available on the Enterprise tier for healthcare customers.
Coordinated vulnerability disclosure
If you believe you have found a security vulnerability in our platform — including the dashboard, scanner fleet, alerting pipeline, public website, or any subdomain — please report it to dancho.danchev@hush.com.
- We acknowledge reports within 24 hours.
- Triage and severity assignment within 72 hours.
- Fix targets: critical 7 days, high 14 days, medium 30 days.
- We credit researchers in our hall of fame unless you request anonymity.
- Safe harbor: we will not pursue legal action against good-faith research conducted within scope.
Out of scope
- Denial-of-service, volumetric, or rate-limit testing.
- Social engineering of staff, customers, or suppliers.
- Findings derived from public configuration of dependencies (please report upstream).
- Self-XSS that requires victim to paste payload into devtools.
- Reports generated solely by automated scanners with no proof-of-concept.
Incident response
We operate a 24/7 on-call rotation across three time zones. Customer-impacting incidents are communicated on the public status page within 15 minutes of confirmed impact, with progress updates every 30 minutes until resolution. A full post-incident review with root cause and corrective actions is published within 5 business days.