Trust center
The security questionnaire, answered once. Last updated November 3, 2026
The short version.
- We store a keyed hash of each email, never the address; IP addresses shortened to their network; counts from the signup page, never what people type.
- Everything travels over HTTPS. Keys and sessions are stored only as hashes; connected-tool credentials are encrypted; backups are encrypted off-site.
- If honeyp.ai is unreachable, your signups keep working: the integration fails open and no check is charged.
- No SOC 2 or penetration test yet. We say so plainly, and we'll complete your questionnaire.
Documents
Need a completed questionnaire in your format (CAIQ, SIG Lite or your own), or a signed DPA? Email
support@honeyp.ai; most answers below can be pasted straight in.
Company
| Question | Answer |
|---|
| Legal entity | Honeyp AI, Inc., a United States company founded in 2026. Contract terms are on the terms page. |
| What the service does | Decides how much free value a new signup should get and links accounts that belong to the same person. It never reads your code and never sees what your users type. |
| Where the service runs | Render, United States (Oregon), with health checks and automatic restarts. One region today; EU-only processing is on the roadmap for Enterprise customers who need it. |
| Subprocessors | Render (hosting), Resend (service email), DreamHost (support mailboxes). Paddle processes payments as its own controller. The list is in DPA Annex III; 30 days' notice before adding one. |
| Who to contact | Security and privacy: support@honeyp.ai. We reply within two business days. |
Data
| Question | Answer |
|---|
| What personal data you send us | An email address, an IP address, a user agent and the browser token for each signup, plus the account id you choose. Optionally usage events and labels afterwards. |
| What we store | A keyed hash of the email (unique to your account) and its domain, the IP shortened to its network, browser family, counts and flags from the form, the decision, score, reasons and your labels. The full list is on the security page. |
| What we never store | Readable email addresses, full IP addresses, keystrokes, passwords or anything typed, names, phone numbers or payment details. |
| Retention | Signup checks are deleted automatically after the period you set: 30 days by default, up to 90 on Trial and Starter, 180 on Growth and 365 on Enterprise, and at most 90 for services used by children. |
| Deleting one person's data | Look up or delete by email or account id in the dashboard, or with POST /v1/privacy/subjects/delete. Privacy requests from the public go through /privacy/request and are answered within 30 days. |
| Deleting everything | The account owner asks from the dashboard; we confirm with them and delete the account and all of its data. |
| Do you train models on our data? | No. Your data protects your own signups. It isn't sold, shared for advertising, used to check other companies' signups or used to train general models. |
| Cookies and tracking on your site | honeyp.js sets no cookies and stores nothing on the device. Our own site uses only the session cookie that keeps you signed in; no analytics or advertising cookies. |
Security
| Question | Answer |
|---|
| Encryption in transit | HTTPS (TLS) for all traffic, including the browser snippet and the API. |
| Encryption and secrets at rest | API keys, sign-in links and sessions are stored only as hashes and shown once. Credentials for connected tools are encrypted at rest. Secrets live only in the hosting environment, never in the code. |
| Backups | A consistent copy of the database every day, with off-site copies encrypted before they leave the server. |
| Application security | Strict content security policy, CSRF tokens checked in constant time, single-use sign-in links and codes with attempt limits, rate limits, origin restrictions on the browser snippet, and outbound requests to customer URLs checked against private-network addresses. |
| Testing | More than 680 automated tests on every change, including browser tests on Chromium, Firefox and WebKit, an accessibility check of every public page, dependency vulnerability audits (Python and npm) and secret scanning of the whole history. Regular attack simulations against our own demo. |
| Vulnerability disclosure | Email support@honeyp.ai or follow security.txt. We reply within two business days and don't pursue good-faith research that follows the rules on the security page. |
| Penetration test, SOC 2, ISO 27001 | Not yet. We'd rather be accurate than impressive: a third-party penetration test is planned first, SOC 2 after it, as customers need them. Ask and we'll tell you the current date. |
Access
| Question | Answer |
|---|
| Who can see our data | Your team, and honeyp.ai staff when helping you. Staff views of your account are recorded in your activity log, and other customers' email hashes are masked in internal tools. |
| How staff sign in | A separate sign-in: an emailed link or code, then a passkey, with short sessions that can be limited to approved networks. |
| How access is granted and reviewed | Only a staff admin can grant or remove staff access. Every grant and removal is in the audit log, and the list is reviewed whenever someone joins or leaves and at least quarterly. |
| Tenant isolation | Each customer's data is separated in every query, and every API key, dashboard session and assistant key belongs to exactly one customer. |
| Your own team's access | Roles for your team, optional passkey requirement for everyone on your account, an audit log of admin actions, and API keys that can be revoked at any time. |
| AI assistants | Your assistant connects read-only through its own key, which you can revoke. It can ask about signups and farms; it cannot change settings or labels. |
Availability
| Question | Answer |
|---|
| What happens if honeyp.ai is down | Your signups carry on. The integration fails open: full credits, with the answer marked as degraded. There is no charge for a check that didn't happen. |
| Status and incident history | The status page shows current state, uptime history and past incidents, and a way to report a problem. |
| Breach notification | If we become aware of a personal data breach affecting your data, we tell you without undue delay and within 48 hours, as set out in the DPA. |
| Support | Email within two business days on Trial and Starter; Slack and email the same business day on Growth; a named contact with agreed hours on Enterprise. |
Privacy and legal
| Question | Answer |
|---|
| Roles | You are the controller of your users' data; we are your processor, acting on your instructions under the DPA. |
| International transfers | The DPA includes the EU Standard Contractual Clauses and covers transfers from the EEA, the United Kingdom and Switzerland to the United States. |
| Automated decisions | Every decision comes with reasons, your thresholds decide the outcome, you can override or label any account, and your users have an appeal page that reaches a person on your team. Offering that review route is required by our terms. |
| Children | Services used by children get shorter retention caps. The platform supports age-gated flows; see the docs and the privacy notice. |
| Documents | Terms, privacy notice, DPA, refund policy, security page. |
Accessibility
| Question | Answer |
|---|
| Standard | Every public page is checked against WCAG 2.2 AA with axe-core on every change, in the same browser test suite as the product. Keyboard focus is visible everywhere, and behaviour signals alone never block a signup, so assistive technology is never a risk signal on its own. |
Something missing? Tell us what your review needs and we'll add it here, so the next team doesn't have to ask.