Encryption
- TLS 1.2+ in transit
- Managed database encryption at rest
- Encrypted backups and object storage
Security & Trust Centre
Built for review boards.
Security is a product requirement in Hoopoe, not a final deployment task. Review how we approach isolation, encryption, auditability, AI governance, and recovery.
Identity controls
- Email and Google sign-in
- Session management
- MFA, SSO, and SCIM on roadmap
Tenant isolation
- Workspace-scoped resources
- Deny-by-default authorization
- Server-side permission checks
Responsible AI
- Human approval before publish
- Workspace-scoped prompts
- Prompt and output audit trail
Current Controls
- Email/password auth
- Google OAuth
- Supabase managed encryption
- Workspace-scoped data model
Roadmap Controls
- TOTP MFA
- SAML SSO
- SCIM provisioning
- Device and session review
Data processing
Your data is yours.
Hoopoe collects only what is needed, scopes prompts and outputs to a workspace, and does not use customer content to train external models without explicit opt-in. Retention is configurable for enterprise workspaces.
We distinguish aligned controls from certifications. Hoopoe does not claim SOC 2 or ISO certification until audits are complete.
Current subprocessors
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, auth, storage | Customer data |
| OpenAI | AI generation | Content prompts and outputs |
| Stripe | Payment processing | Billing data |
| Hosting platform | Application hosting | Application data |
Retention and data rights
Active subscription data is retained while the workspace is active. Export, correction, deletion, and objection workflows follow GDPR-aligned handling.
Incident response
Detection, triage, containment, communication, eradication, recovery, and lessons learned are tracked through a formal process.
Business continuity
Automated backups, restoration tests, recovery objectives, and disaster recovery exercises are part of the operating model.
Responsible AI controls
Human approval before publishing
Source grounding in approved knowledge
Restricted language enforcement
AI-generated content disclosure
Sensitive-topic escalation
Model and prompt logging
Compliance roadmap
| Framework | Status | Target |
|---|---|---|
| GDPR | Aligned | Current |
| CCPA | Aligned | Current |
| SOC 2 Type II | Planned | Q4 2026 |
| ISO 27001 | Planned | 2027 |
| HIPAA | Not planned | - |
Need a security review packet?
Request architecture notes, subprocessor details, controls, recovery targets, and the current compliance roadmap.
Contact security