Trust Center

At a glance

Certifications & compliance

We hold ISO/IEC 27001:2022 certification for our information security management system.

Internal audit and management review run annually between external surveillance audits.

Regulatory framework

We hold no SOC 2 report, FedRAMP authorization, or PCI QSA status.

Data residency

Customer engagement data processed by hackurity.io B.V. is stored and processed in the European Union, in AWS region eu-central-1 (Frankfurt, Germany). Hackurity does not replicate, back up, or fail over customer engagement data outside the European Union.

Where a subprocessor's parent entity sits outside the EU, transfers rely on Standard Contractual Clauses (EU 2021/914) and, for certified US vendors, the EU-US Data Privacy Framework.

On the CLOUD Act. AWS is US-headquartered. Our data stays in Frankfurt under contractual and technical commitment, encryption at rest applies throughout customer-managed KMS keys, and we notify the affected customer of any government access request unless legally prohibited.

Subprocessors

A subprocessor is a third party that processes customer personal data on our behalf. Under GDPR Art. 28(2) we owe you notice before adding one.

AI processing. Customer data is processed by the AI subprocessors above under model training exclusions. We hold a direct contract covering this processing: submitted data is used only to serve Hackurity, is encrypted in transit and at rest, is never shared with third parties, is never used to train models, and is not reviewed by humans.

Change notification. We give 30 days' notice before a new subprocessor begins processing. Customers can object on reasonable data protection grounds, and where an objection cannot be resolved, terminate the affected service without penalty. To join the notification list, email hello@hackurity.io.

Data handling & retention

Offensive security work produces material more dangerous than the systems it describes. A finished penetration test report is a working guide to compromising the customer.

Classification

Retention

Deletion uses srm, cryptographic erasure, or equivalent multi-pass overwrite, and is logged with date, analyst, method, and verification. A certificate of deletion is available on request. Customers can request earlier deletion at any time.

Security practices

Privacy & GDPR

Your rights under Articles 15 to 21 - access, rectification, erasure, restriction, portability, objection. Submit a request to gdpr@hackurity.io. We verify identity, then respond within 30 days, extendable by 60 days for complex requests under Art. 12(3). No charge.

Complaints go to us, and to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

An Art. 28-compliant Data Processing Agreement is provided at contract stage or on request, with SCCs where transfers apply.

Full privacy notice: Privacy Policy.

Vulnerability disclosure

We run offensive security for a living. We would rather hear about a flaw in our systems from you than from a customer.

Report to security@hackurity.io. Acknowledgment within 2 business days. Our machine-readable policy is published at /.well-known/security.txt.

Safe harbor. Research conducted in good faith under this policy is authorized. We will not pursue civil action or refer you to law enforcement for activity that follows it, and where a third party acts against you for compliant research, we will say so. Our authorization covers our own systems and cannot extend to a customer environment.

Rules. Stop at proof of concept. Use your own test accounts. Do not access another party's data, run denial of service, or pivot further after establishing access. A report accompanied by a payment demand is handled as extortion.

Disclosure window is 90 days, extendable by agreement. Named credit on request. A monetary bounty is offered for findings in our customer-facing portals and platforms. Findings in our honeypots do not qualify for a bounty.

Incident response

Suspected exposure of your data: email security@hackurity.io with a subject line beginning INCIDENT.

As processor, we notify you; as controller, you notify your supervisory authority within 72 hours (GDPR Art. 33). Notifications state the nature of the breach, categories and approximate volume of data affected, likely consequences, measures taken, and a contact point. Where the full picture is not yet available, we send what we have within the deadline and follow up.

A post-incident review completes within 10 business days of closure, with corrective actions tracked in the ISMS register.

Business continuity

Environmental

Our footprint sits in cloud compute and staff working arrangements. Infrastructure runs in AWS eu-central-1. Amazon reports matching 100% of the electricity consumed across its operations with renewable energy, and targets net-zero carbon by 2040. (Source: sustainability.aboutamazon.com)

Our broader commitments are set out in our Environmental Policy.

Compliance documents

Public: this page, our Threat Intelligence Data Handling Policy, the vulnerability disclosure policy, security.txt, and the subprocessor list.

Under NDA: ISO 27001 Statement of Applicability, surveillance audit summary, third-party penetration test attestation, business continuity and restore test evidence, Transfer Impact Assessments, insurance certificates.

Request them from hello@hackurity.io, stating the requesting entity, the documents needed, and the purpose. Released within 5 business days of NDA execution.

We complete customer security questionnaires. Most answers are already on this page, so linking the relevant section is usually faster than a spreadsheet.

Contact

Legal & policies

• Privacy Policy: how we collect, use, and protect personal data.
• Terms & Conditions: the terms governing use of our platform and services.
• Environmental Policy: our commitment to sustainable, responsible operations.