Security
- We collect very little: a keyed hash of each email (never the address), IP addresses shortened to their network, counts from the signup page (never what people type), and a keyed hash of the device's configuration.
- Everything travels over HTTPS. API keys, sign-in links and sessions are stored only as hashes; credentials for your Jira or Asana are encrypted.
- Each customer's data is separated in every query, and you choose how long we keep it (up to 90 days on Trial and Starter, 180 on Growth and 365 on Enterprise).
- If honeyp.ai is ever unreachable, your signups keep working: integrations fail open by design.
Data we hold, and what we don't
| We store | We never store |
|---|---|
| A keyed hash of each email (unique to each customer) and its domain | Email addresses in readable form |
| IP addresses shortened to their network (the first three parts) | Full IP addresses |
| Browser family, and counts and flags from the signup page | Keystrokes, passwords or anything typed |
| The decision, score, reason codes and your labels | Names, phone numbers or payment details of your users |
The free abuse audit goes further: your users' emails and IP addresses never leave your browser. See the privacy notice and DPA for the full detail.
How we protect it
Encryption
HTTPS (TLS) for all traffic. API keys, sign-in links and sessions stored only as hashes. Credentials for connected tools encrypted at rest.
Access control
Customers are isolated in every query. Staff use a separate sign-in: an emailed link or code, then a passkey, with short sessions that can be limited to approved networks. Only staff admins can grant or remove access, and customers can require passkeys for their own team.
Application security
Strict content security policy, CSRF protection, single-use sign-in links and codes with attempt limits, rate limits, and origin restrictions for the browser snippet.
Accountability
An audit log of staff and customer admin actions, and a privacy log of data requests that holds no raw identifiers.
Retention
Signup checks are deleted automatically after the period you set (up to 90 days on Trial and Starter, 180 on Growth and 365 on Enterprise; 30 by default). Deletion requests are handled from your dashboard or the API.
Testing
About 600 automated tests, including browser tests, run on every change, plus regular attack simulations against our own demo.
Hosting and subprocessors
honeyp.ai runs on Render (United States, Oregon) with health checks and automatic restarts. Emails are sent through Resend. Push notifications go through your device's push service only if you turn them on, encrypted end to end. The current list is in DPA Annex III; we give 30 days' notice before adding a subprocessor.
Incidents
If we become aware of a personal data breach affecting your data, we tell you without undue delay and within 48 hours, with what we know and what we're doing about it, as set out in section 7 of the DPA.
For your security review
| Question | Answer |
|---|---|
| Where does data live? | Render, United States (Oregon). Subprocessors are listed in DPA Annex III. |
| Who can see our data? | Your team, and honeyp.ai support staff when helping you. Staff views of your account are recorded in your activity log, and other customers' emails are masked in our internal tools. |
| Can we delete a person's data? | Yes: look up or delete by email or account ID in the dashboard, or with POST /v1/privacy/subjects/delete. |
| Can we delete everything? | Yes. The account owner asks from the dashboard, we confirm with them and delete the account and all its data. |
| What happens if honeyp.ai is down? | Your signups carry on: the integration fails open and marks the answer as degraded. Live status and history are on the status page. |
| Can we review or override decisions? | Yes. Shadow mode first, your own thresholds, labels on any account, review tasks in Jira or Asana, and an appeal page for your users. |
| How do we know it's accurate for us? | Your dashboard compares our flags with your own labels: how often we were right, how many real users were flagged and how much abuse was missed. |
| Do you train AI models on our data? | No. Your data is used to protect your own signups; it isn't sold, shared or used to train general models. |
Need more detail, our detection approach or a completed questionnaire? Email support@honeyp.ai. We share specifics of how detection works privately, so it doesn't become a guide for the people it's meant to stop.
Compliance status
We're an early-stage company and we'd rather be accurate than impressive:
- DPA with EU Standard Contractual Clauses and the UK Addendum: available now.
- Security questionnaire: we'll complete yours; ask us.
- SOC 2 and penetration test: not yet. Both are planned as customers need them.
Report a vulnerability
If you've found a security issue, email support@honeyp.ai with the details and steps to reproduce. We'll reply within two business days and keep you updated. Please don't access other people's data, disrupt the service or publish the issue before we've fixed it; we won't pursue good-faith research that follows these rules. Our security.txt has the same contact.