Security & compliance
Transparency into how we protect your data, maintain compliance, and secure our infrastructure.
Built on Google Cloud.
Every service, dataset, and key lives on Google Cloud, in US regions only. The attestations below are Google’s, and they cover the ground we stand on — not our own audit.
Our SOC 2 Type II audit is on our roadmap for 2026–2027, once our customer mix justifies the audit cycle. Until then, our standing posture is documented in the Security Practices Overview and Questionnaire below, running on SOC 2-certified Google Cloud. The attestations listed below belong to Google Cloud Platform, not Hail Sentinel.
All Hail Sentinel infrastructure inherits the following attestations via Google Cloud Platform:
Primary region us-central1 · BigQuery US multi-region · Firestore nam5
Your data, protected at every layer.
Encryption, access control, and auditability baked into every request — from the mobile client to the BigQuery row.
Encrypted everywhere
AES-256 at rest, TLS 1.3 in transit. HSTS, CSP, and strict CORS on every web surface. API keys cryptographically hashed. Webhook payloads signed with replay protection.
Access controlled
Role-based permissions. Scope-based API keys. Firebase App Check device attestation on iOS and Android. Rate limiting on all endpoints.
Continuously audited
Comprehensive audit logs across all services. Structured request logging. Real-time monitoring with automated alerts.
SSRF protection
Private IP blocking on outbound requests. Validated webhook URLs. HTTPS enforced on every integration.
Privacy by design
Geohash discretization. Firebase UID pseudonymization. No ad tracking. No data selling.
Infrastructure as code
All resources defined in Terraform. Automated TFSec scanning on every deploy. Pinned versions, signed artifacts.
How long we keep things, and under whose rules.
Every category has a stated life and a stated reason. Deletion is available on request in all of them.
Data deletion available on request under CCPA/CPRA and other U.S. state privacy laws. Contact privacy@hailsentinel.com.
Who else touches your data.
We carefully vet every third party that processes your data and give 30 days advance notice before adding or replacing one.
Everything your security team will ask for.
Both reports read on the web and print to PDF. Anything they don’t answer — your own questionnaire, contract terms, a contractual SLA — we handle by agreement when your invite is issued.
Infrastructure architecture, encryption standards, access controls, compliance framework, incident response, and the full vendor footprint. Written to be forwarded to a security team as-is.
Our standing answers to the usual third-party risk items — company, data security, application security, vendors, continuity, compliance. A full SIG-Lite or CAIQ on request via legal@hailsentinel.com.
Questionnaire items, architecture questions, or a vulnerability report — one address, answered by the people who built it.
security@hailsentinel.com
PGP fingerprint and disclosure policy in /.well-known/security.txt