Sub-processors & Security
To run HukProof we rely on a small set of trusted infrastructure providers (“sub-processors”) that may process personal data on our behalf. This page lists them and summarizes how we protect your data.
1. Current sub-processors
Each sub-processor is engaged under a contract requiring appropriate technical and organizational safeguards, and is used only for the purpose shown.
| Sub-processor | Purpose | Primary region |
|---|---|---|
| Neon | Managed PostgreSQL database (application data) | United States |
| Render | Application & API hosting, click/open tracking service | United States |
| Vercel | Web app hosting & content delivery | United States / Global edge |
| Cloudflare | DNS, TLS, CDN, and object storage (R2) for uploaded logos and encrypted backups | Global edge |
| Resend | Marketing, promotional, and transactional email delivery | United States |
| OVHcloud | Dedicated infrastructure for simulation-email delivery | Canada |
2. Changes to this list
As we grow we may add or replace sub-processors. In line with the GDPR and India’s DPDP Act, we keep this list current and give advance notice of any new sub-processor before it begins processing personal data — by updating this page and, for customers who subscribe to notifications or are under a data-processing agreement, by email — so you can raise any objection on reasonable data-protection grounds. To be notified of changes, email privacy@hukproof.com.
3. How we protect your data
This is the legal summary. For a plain-language walkthrough of how HukProof handles your team’s data — what we encrypt, what we deliberately never store, and how tenants are kept apart — see the Security overview.
Encryption
- In transit: all traffic is encrypted with TLS.
- At rest: the most sensitive fields — employee names and email addresses — are encrypted with AES-256-GCM. Each record has its own data key, wrapped by a master key held separately from the database. Passwords are stored only as salted bcrypt hashes.
Tenant isolation
Every organization’s data is isolated at the database layer using PostgreSQL row-level security, so one tenant’s queries can never read another tenant’s rows.
Access & authentication
- Optional two-factor authentication (TOTP) and account lockout on repeated failed logins.
- Least-privilege internal access and audit logging of sensitive actions.
- Administrative tooling is gated behind a separate, explicitly-allowlisted access check.
Abuse-prevention safeguards
By default, HukProof restricts simulation recipients to a customer’s own registered email domain and blocks generic consumer providers — a technical guardrail that keeps the tool pointed only at a customer’s own workforce, consistent with our Acceptable Use Policy.
Platform hardening
We apply security headers (Content-Security-Policy, HSTS, frame denial, no-sniff), parameterized database access, per-route rate limiting and login lockout, strict cross-origin controls, and we scope error messages so internal details are not leaked.
4. Breach notification
If we become aware of a personal-data breach affecting your data, we will notify you (as controller) without undue delay and provide the information you need to meet your own obligations. Where we are the controller, we will notify the relevant authority and affected individuals where required by law (for example, GDPR Articles 33–34 and the DPDP Act). See the Privacy Policy for details.
5. Data-processing agreement
For enterprise engagements we make available a Data Processing Agreement (DPA) that incorporates this sub-processor list and the appropriate international-transfer safeguards (such as the EU Standard Contractual Clauses). To request one, email privacy@hukproof.com.
6. Responsible disclosure
If you believe you’ve found a security vulnerability, please report it responsibly to privacy@hukproof.com and give us reasonable time to remediate before any public disclosure. See our Vulnerability Disclosure Policy for scope, rules of engagement, and our good-faith safe harbor. We appreciate the security community’s help.