We build infrastructure that runs research workloads and trains models on customer data, so security and isolation are core to the product, not an afterthought. This page summarizes our posture in plain language. It is a living document and will expand as our program matures.
Data handling
- Encryption in transit and at rest. All traffic is served over TLS 1.2+; data at rest is encrypted with AES-256 using managed keys with rotation.
- Data minimization and retention. On the self-serve tier we retain inputs, outputs, and logs for a limited window to operate, debug, and secure the service. Enterprise customers can contract for stricter handling, including custom retention and zero data retention (ZDR). See our Privacy Policy and your order form for specifics.
- No training on customer data without permission. We do not train models on enterprise customer data. Self-serve terms describe any default use; enterprise terms are no-training by default.
Workload isolation
Because our product can execute customer-provided code and run experiments on customer data, isolation is the center of our threat model:
- Workloads run in cell-owned, identity-fenced sandbox pods. Isolation strength is explicit per profile; the platform does not describe ordinary Kubernetes isolation as a dedicated kernel.
- Tenants are isolated at the data layer (scoped credentials, row-level security) with explicit tests for cross-tenant access.
- Customer models are isolated per tenant and are never co-mingled.
Infrastructure
- Hosted on major cloud providers; production access is least-privilege and gated by SSO + MFA.
- Audit logging is enabled across production systems.
- Secrets are stored in a managed secrets manager, never in source code.
Sub-processors
We publish the third parties that may process customer data on our sub-processors page, with advance notice of changes.
Compliance roadmap
- SOC 2 (Security): in progress.
- Additional frameworks will be scoped as customer needs require.
Live compliance status and security documents are available in our trust center.
Reporting a vulnerability
We welcome responsible disclosure. Email security@hiloop.ai with details and steps to reproduce. Please give us reasonable time to remediate before any public disclosure. See also our security.txt.
Contact
Security questions: security@hiloop.ai. Privacy questions: privacy@hiloop.ai.