Security Hall of Fame
We thank the following security researchers for responsibly disclosing vulnerabilities:
Built by security professionals, for security professionals. Security is at the core of everything we do.
All data is encrypted in transit using TLS 1.3 with perfect forward secrecy. Data at rest is encrypted using AES-256-GCM. Encryption keys are managed through AWS KMS and Azure Key Vault.
Your deployments run in isolated Virtual Private Clouds (VPCs) with private subnets, security groups, and network ACLs configured according to security best practices.
Role-based access control (RBAC), multi-factor authentication (MFA), and principle of least privilege ensure only authorized users can access your systems.
Comprehensive audit logging, real-time security monitoring, and anomaly detection ensure threats are identified and responded to immediately.
Regular vulnerability scanning, dependency updates, and third-party penetration testing ensure our software remains secure against emerging threats.
Documented incident response procedures, 24/7 security operations center, and customer notification protocols ensure rapid response to security events.
HailBytes takes security vulnerabilities seriously. We appreciate the security research community helping us maintain the highest level of security for our customers.
The following are in scope for vulnerability disclosure:
To report a security vulnerability, email us at:
security@hailbytes.com
Please include:
When you report a vulnerability in good faith, we commit to:
If you comply with these guidelines and act in good faith, we will not initiate legal action against you or ask law enforcement to investigate you. We consider security research conducted under this policy to be authorized.
Our infrastructure and operations follow SOC 2 Type II framework principles with security, availability, and confidentiality controls aligned to industry best practices.
Status: Framework aligned
Controls: Access management, monitoring, encryption
Our Information Security Management System (ISMS) follows ISO/IEC 27001:2013 framework for systematic approach to managing sensitive information.
Framework: ISO/IEC 27001:2013
Practices: Risk management, ISMS policies
Annual third-party penetration testing by leading security firms validates our security posture. Findings are remediated according to severity with critical issues fixed within 7 days.
Frequency: Annual (plus ad-hoc testing)
Reports Available: To enterprise customers
All HailBytes employees undergo security awareness training, secure coding training, and regular phishing simulations (using our own GoPhish Cloud, naturally).
Training: Quarterly security awareness
Simulations: Monthly phishing tests
We follow secure software development lifecycle (SSDLC) practices to ensure our code is secure:
We carefully vet and monitor all third-party dependencies and services:
We thank the following security researchers for responsibly disclosing vulnerabilities:
Our security team is available to answer questions, provide documentation, and assist with security assessments for enterprise customers.
