Security overview
How Heardback, operated by Heardback (company in formation), protects the data it processes. This page is a plain summary; the data processing addendum sets the contractual commitments.
Data minimisation
- Respondents answer without an account. The only identifier is a random session cookie.
- Phone numbers and emails are optional and are stored twice: a keyed hash for lookup and an encrypted copy for sending. They never appear in logs, events, analytics or prompts sent to AI providers.
- Reveal cards are only generated once at least twelve people have answered a question.
Encryption
- In transit: TLS 1.2 or later everywhere, including between the web front end and the API.
- At rest: managed database encryption plus application-level encryption (AES-128-CBC with HMAC, via Fernet) for contact details, with the key held in the application environment, not the database.
Access
- Production access is limited to named operators using individual credentials and is logged.
- The operator console is read-only and protected by a secret rotated on staff changes.
- Secrets live in the hosting provider's environment store, never in the code repository.
Infrastructure
- Database and file storage in ap-south-1 (Mumbai) with daily backups retained for 7 days.
- The API and web front end run on managed platforms listed under sub-processors, patched by the provider.
- Dependencies are pinned and updated on a monthly cadence, sooner for security advisories.
Software practices
- Every change is reviewed and passes automated tests before release, including tests for consent recording, deletion, export and idempotency.
- Input from respondents is validated and never executed; AI outputs are schema-checked before use.
- A retention job runs daily to abandon idle sessions, scrub old free-text, and purge stale waitlist entries.
Incident response
We keep an incident log, assess every event for personal-data impact, and notify affected askers within 48 hours and authorities and individuals as the law requires.
Reporting a vulnerability
Email privacy@heardback.co with the subject "security". We acknowledge within two business days, do not pursue good-faith researchers, and credit fixes on request.