Hayaiti / Trust Center
—
No certification theater. We’re an early-stage studio — we’ll show you the real controls, the real subprocessors, and the real roadmap to SOC 2 Type II. Every claim on this page is one we can defend.
01 / Security
Defense in depth from the edge to the database. Every Hayaiti project ships behind the same hardened defaults so no client inherits a per-project regression.
Encryption
TLS 1.3
AES-256-GCM at rest · TLS 1.3 in transit · keys rotated annually.
Project isolation
1 engagement, 1 account
Each client gets a dedicated cloud account, repo, and credential set. No cross-project data colocation.
Backups
Daily · 30-day
Encrypted automated backups · 30-day point-in-time recovery · quarterly restore drills on internal systems.
Pentest
Q1 2027 target
Engaging an external pentest firm before our SOC 2 Type II window. Until then, every release ships with a written threat model and security review.
Every app we ship lands behind the same hardened defaults — no per-project regressions.
Customer data is encrypted, scoped, and observable — both at rest and in transit.
We don't reinvent boring problems — we build on platforms that already pass the audits.
02 / Privacy
Six rights guaranteed by GDPR & CCPA, honored regardless of where you live. The full privacy policy is at /privacy.
Request a copy of every piece of personal data we hold about you. Delivered as a portable JSON export within 30 days.
Correct anything inaccurate. Most fields are self-serve in your account; the rest take a single email to privacy@hayaiti.com.
Delete your data on request, subject only to retention required by law (e.g. invoices for tax). Hard-delete, not soft-flag.
Take your data with you. Export in a structured, machine-readable format on demand — no platform lock-in.
Opt out of any processing based on legitimate interest, including analytics and product communications.
If we ever fall short, you can file a complaint with your local data protection authority. We’ll respond fully to any inquiry.
Access matrix
You (the customer)
All data you submit, plus audit logs of every change.
Hayaiti engineering on-call
Production access, time-boxed, MFA-gated, fully logged.
Subprocessors
Only the slice of data needed for their function — see list below.
Hayaiti operations
Billing data only (Stripe-hosted, never card numbers).
Marketing / sales
Aggregated, anonymized usage metrics — no individual records.
03 / Compliance
We’re an early-stage studio. Most enterprise certifications are an audit cycle away, not a logo. Here is the honest state of every framework you might care about.
GDPR
Regulation
EU General Data Protection Regulation. Lawful basis, data subject rights, breach notification within 72 hours, and a published subprocessors list — all in place.
Privacy PolicyCCPA / CPRA
Regulation
California Consumer Privacy Act. Right to know, delete, correct, and opt-out of sale. We do not sell personal information.
Privacy PolicySOC 2 Type II
Framework
AICPA Trust Services Criteria for Security, Availability, and Confidentiality. We are operating to SOC 2 controls today; formal audit and report come after the readiness assessment.
Target: Readiness Q3 2026 · Type II report Q1 2027
Email for status updateISO 27001
Standard
Information Security Management System. Planned to begin alongside SOC 2 Type II once the first audit cycle completes.
Target: Scoping 2027
HIPAA
Regulation
U.S. healthcare data. We engineer to HIPAA-aware standards (encryption, access controls, audit logging) and can sign a Business Associate Agreement on a per-engagement basis. We are not certified — HIPAA has no certification body.
Request a BAAPCI DSS
Standard
Payment Card Industry Data Security Standard. We never touch card data — Stripe handles all payment flows as a PCI DSS Level 1 service provider. Our integration uses Stripe Elements / Checkout, so we are out of scope.
Stripe security“In progress” means we are operating to the framework’s controls today; the formal audit is the open work. “Aware” means we engineer to the standard but the regulation has no certifying body. Anything not on this list, ask us — we’ll tell you the truth.
04 / Subprocessors
GDPR Article 28 requires us to publish the third parties that process customer data on our behalf. We give you their DPA directly so you can verify upstream — no hidden chains.
Vercel
DPA ↗Application hosting, edge compute, image optimization.
United States · European Union (configurable per project)
Cloudflare
DPA ↗DNS, CDN, WAF, DDoS protection, bot management.
Global edge (300+ POPs)
Stripe
DPA ↗Payment processing, billing, payouts, fraud detection.
United States · European Union
GitHub
DPA ↗Source code hosting, CI/CD, issue tracking for client work.
United States
Slack
DPA ↗Real-time team and per-client communication channels.
United States
PostHog
DPA ↗Product analytics, session replay, feature flags.
United States · European Union (EU Cloud option)
Sentry
DPA ↗Error monitoring, performance regression alerts.
United States · European Union
Subscribe to subprocessor changes. We notify customers 30 days before adding a new vendor.
Subscribe05 / Incident response
A real runbook, not a slogan. Times below are the upper bounds we commit to — written, signed, and auditable.
Continuous
Alerting from Sentry, Cloudflare, uptime probes, and audit log anomaly detection. Customer reports flagged at security@hayaiti.com.
Within 4 hours
Severity assigned (SEV-1 → SEV-4), incident commander designated, war-room channel opened, scope of impact assessed.
Within 12 hours
Affected systems isolated · keys rotated · attacker pathway closed. Evidence preserved for forensics before any rebuild.
Within 72 hours
Affected customers notified directly per GDPR Article 33. Status page updated. Regulators contacted where required.
Within 14 days
Blameless postmortem authored. Root cause, timeline, and corrective actions published — publicly when the customer permits, otherwise privately to all affected parties.
Status page
Real-time uptime for every Hayaiti service. Historical incidents are kept indefinitely with full postmortems linked.
status.hayaiti.comNotifications
Email, RSS, or webhook. Critical incidents always page customer admins directly — no need to subscribe for SEV-1.
security@hayaiti.com06 / Pentest & bounties
We don’t have a fresh pentest report to wave around — and we’re not going to fake one. Here is what we’re doing instead, and when the report will exist.
Scheduled Q3 2026
First annual external penetration test against hayaiti.com and admin surfaces. Executive summary published as soon as remediation closes.
Active
Every release cycle ships with a written threat model and a security-review checklist (ASVS L2). We eat our own dogfood before we point it at clients.
Q4 2026 (planned)
Public program with safe-harbor terms (already published) and a structured payout table. Currently accepting reports under our disclosure policy.
Methodology
OWASP ASVS L2 baseline. Scope: web app, API, identity provider, edge config. External tester credentialed on CREST or OSCP minimum.
Disclosure
Safe-harbor disclosure policy already in force. SLAs published. Researchers credited publicly with consent.
/disclosureLab work
Open-source security tooling and write-ups we publish under Hayaiti Labs. Real engineering, no inflated CVE counts.
/labs07 / Downloads
Everything we can hand you today — and a clear date for everything we can’t. No fake report links.
Contact
Founders read every message. Acknowledgement within 2 business days; security reports faster. PGP available on request.
Security reports
security@hayaiti.com
Vulnerabilities, suspected breaches, urgent matters.
Privacy requests
privacy@hayaiti.com
Data subject rights, access, deletion, portability.
Legal & contracts
legal@hayaiti.com
DPAs, BAAs, MSAs, vendor questionnaires.
For PGP-encrypted security reports, see /disclosure.