Bank-grade security, by default.
Security is not an afterthought at SendHup. It is woven into every layer of our architecture, every process, and every decision we make.
Security Practices
Encryption Everywhere
All data is encrypted in transit with TLS 1.3 and at rest with AES-256. No plaintext ever touches the wire. API keys, tokens, and secrets are stored in dedicated vaults with automatic rotation.
Access Control
Role-based access with least-privilege principles. Every dashboard action requires authentication. Scoped API keys restrict access by channel, IP range, and rate limit.
Audit Logging
Every administrative action, API call, and system event is recorded in immutable audit logs. Logs are retained for 12 months and are available for compliance review.
Infrastructure Security
Multi-region deployment with network isolation, DDoS protection, and automated failover. All infrastructure is managed as code with version-controlled configurations.
Signed Webhooks
Every webhook payload is signed with HMAC-SHA256, allowing you to verify authenticity and prevent tampering. Replay protection via timestamp validation.
Vulnerability Management
Regular penetration testing by independent security firms. Automated dependency scanning on every build. Critical patches deployed within 24 hours of disclosure.
Compliance & Certifications
SOC 2 Type II
ReadyArchitecture designed for SOC 2 compliance with continuous monitoring controls.
GDPR
CompliantFull compliance with EU data protection requirements. DPA available on request.
CCPA
CompliantHonoring California consumer privacy rights with transparent data practices.
HIPAA
AvailableBAA available for healthcare customers upon request.
Responsible Disclosure
We value the security research community. If you discover a vulnerability in our systems, please report it responsibly. We commit to acknowledging reports within 24 hours, working with you to understand and resolve the issue, and providing credit where appropriate.
Send security reports to security@sendhup.com. Please include detailed reproduction steps and allow reasonable time for remediation before any public disclosure.