Security at HailBytes

Encryption Everywhere

All data is encrypted in transit using TLS 1.3 with perfect forward secrecy. Data at rest is encrypted using AES-256-GCM. Encryption keys are managed through AWS KMS and Azure Key Vault.

• TLS 1.3 with modern cipher suites
• AES-256 encryption at rest
• Hardware Security Module (HSM) backed keys
• Automatic key rotation

Network Security

Your deployments run in isolated Virtual Private Clouds (VPCs) with private subnets, security groups, and network ACLs configured according to security best practices.

• Private subnet isolation
• Web Application Firewall (WAF)
• DDoS protection (AWS Shield, Azure DDoS)
• Network traffic logging and monitoring

Access Controls

Role-based access control (RBAC), multi-factor authentication (MFA), and principle of least privilege ensure only authorized users can access your systems.

• Multi-factor authentication (MFA) required
• Role-based access control (RBAC)
• Single Sign-On (SSO) support
• Regular access reviews and audits

Monitoring & Logging

Comprehensive audit logging, real-time security monitoring, and anomaly detection ensure threats are identified and responded to immediately.

• 24/7 security monitoring
• Comprehensive audit logs
• Real-time alerting for anomalies
• SIEM integration support

Vulnerability Management

Regular vulnerability scanning, dependency updates, and third-party penetration testing ensure our software remains secure against emerging threats.

• Weekly vulnerability scanning
• Automated dependency updates
• Annual penetration testing
• Bug bounty program

Incident Response

Documented incident response procedures, 24/7 security operations center, and customer notification protocols ensure rapid response to security events.

• 24/7 security operations center
• Documented IR procedures
• Customer notification within 72 hours
• Post-incident analysis and reporting

SOC 2 Aligned Controls (US AICPA)

HailBytes infrastructure and operations follow SOC 2 Type II framework principles — the primary US Enterprise procurement attestation — with security, availability, and confidentiality controls aligned to AICPA best practices. SOC 2 Type 2 direct audit engagement with Jack Moore Group is in late-stage contracting; target attestation 2026-H2 to 2027-Q1 contingent on observation-window completion.

Status: Framework aligned, Type 2 direct engagement signature imminent
Controls: Access management, monitoring, encryption

ISO 27001 Aligned Practices (Global)

HailBytes’ Information Security Management System (ISMS) follows the international ISO/IEC 27001:2022 framework for systematic management of sensitive information. Formal certification is evaluated post-SOC 2 Type 2 attestation.

Framework: ISO/IEC 27001:2022 (international)
Practices: Risk management, ISMS policies, Annex A controls

Penetration Testing

Annual third-party penetration testing by leading security firms validates our security posture. Findings are remediated according to severity with critical issues fixed within 7 days.

Frequency: Annual (plus ad-hoc testing)
Reports Available: To enterprise customers

Security Awareness Training

All HailBytes employees undergo security awareness training, secure coding training, and regular phishing simulations using HailBytes SAT.

Training: Quarterly security awareness
Simulations: Monthly phishing tests

Operating system baseline

• Ubuntu 24.04 LTS with minimized package set
• Kernel parameters tuned for network and memory hardening (net.ipv4.tcp_syncookies=1, kernel.kptr_restrict=2, etc.)
• Unattended security updates enabled by default
• Audit subsystem (auditd) capturing privileged commands and authentication events
• Time sync via chrony against the public NTP pool

SSH daemon

• Password authentication disabled; key-based only
• Root login disabled
• KexAlgorithms restricted to curve25519-sha256 and diffie-hellman-group16-sha512 family
• Ciphers restricted to chacha20-poly1305 and AES-GCM
• MACs restricted to ETM-mode SHA-2
• Login grace time tightened, max sessions capped

Web stack

• TLS 1.2/1.3 only; modern cipher suites; HSTS enabled
• Content Security Policy with per-request nonces on inline scripts
• X-Frame-Options, X-Content-Type-Options, Referrer-Policy set to restrictive values
• Application-layer rate limits (anonymous 20/min, authenticated 200/min, scan initiations 10/min) returning 429 with Retry-After
• Input sanitization with output encoding for all UI-rendered content

Application layer

• API keys SHA-256 hashed at rest; plaintext value never stored
• Per-key expiration and per-key revocation
• OIDC SSO with role mapping; SCIM provisioning available
• 21-action audit log including actor, IP, user agent, and target resource
• RBAC scoped to projects and organizations for multi-tenant deployments

Database & data path

• PostgreSQL 16 with PgBouncer connection pooling
• Encryption at rest via cloud-provider managed keys (AWS KMS, Azure Key Vault)
• Daily automated snapshots; point-in-time recovery on managed deployments
• Database listeners bound to the application network only; no public exposure
• Migrations gated through the application; no manual schema drift

Container & build chain

• Multi-architecture images (ARM64 and AMD64), pre-built Go tool binaries
• Images scanned with Trivy in CI; vulnerable releases blocked
• Marketplace images built reproducibly via Packer
• OIDC federation for AWS and Azure marketplace CI builds (no long-lived cloud credentials)
• SBOM generated on every release