HukProof runs safe, simulated social-engineering tests against your own staff, so we hold real people’s contact details. That’s a responsibility, not a footnote. This page is the specifics — the actual mechanisms — and everything below is something a technical reviewer on your side can verify.
What we deliberately never keep
A simulation sometimes ends with an employee typing a password into a fake login page. That’s the moment the exercise exists to catch — and the moment a careless tool would capture a real, working credential. HukProof does not. When a simulated login form is submitted, the server records only the name and length of each field; the value itself is never written, logged, or sent anywhere. An automated test fails the build if a raw value ever survives.
••••••••password ••••••Illustrative example
In transit, at rest, and in backups
One customer can never see another’s data
Many companies share infrastructure, so the boundary between tenants matters most. We enforce it at the database layer with row-level security, not in application code where a missed check would leak data. Every request runs under a restricted role scoped to a single organisation; a query that tried to read another company’s rows returns nothing, even if the application above it has a bug.
Who gets in, and what’s recorded
The tool can only point at your own people
A simulation tool aimed at the wrong inbox is a weapon. By default HukProof restricts every simulation to addresses on your own registered domain and blocks generic consumer providers — a technical guardrail, not just a line in the terms. The application itself is hardened throughout with standard web-security controls.
Where your data lives, and who touches it
Application data is held in a managed PostgreSQL database in the United States. The service runs on a deliberately small set of named providers — each listed, with its purpose and region, on the pages below. We keep that list current and give notice before adding a new one.
Honest about stage
Not yet
What we can point to
Email us directly. A person who works on the product answers — not a ticketing queue. See our disclosure policy.
Free for up to 100 people. No card, no consultant, no three-month onboarding.