The contact details your customers give you — names, phone numbers, addresses — are yours. Hardtack is designed so our team can run your platform without browsing them: admin and support surfaces show aggregated and tokenized data, with PII redaction enforced in code at the read layer. The trust boundary lives in the system, not just in a policy we promise to follow.
Security isn't a page we bolt on at launch — it's how the system is put together. The essentials:
TLS in transit; sensitive customer fields — names, phones, emails — encrypted at rest.
Every operator's data is fenced at the database with Postgres row-level security — not just in the app layer.
Passwordless magic-link sign-in, mandatory two-factor (TOTP) for admins, HttpOnly session cookies, and step-up confirmation on sensitive actions. The app itself connects with a least-privilege database role.
The AI proposes; you approve. Irreversible and high-dollar actions are bounded in code and need your sign-off — and the voice agent never treats caller ID as proof of identity.
Daily encrypted, off-site backups plus point-in-time recovery, with restores periodically tested.
We configure AI model vendors to disable training on your data and turn on available logging opt-outs, and we redact PII before it reaches a model.
We've completed a full security review and remediate findings on a defined timeline (see below). We maintain a current list of sub-processors and their data-handling terms, available on request. A SOC 2 audit is on our roadmap; what's described above is what the platform does today.
Evaluating Hardtack and need security details or a questionnaire completed? Get in touch — that's separate from the vulnerability mailbox below.
Hardtack runs a Vulnerability Disclosure Program. Report security issues to security@hardtack.ai — please redact sensitive payloads in the email body; we'll move to a secure channel if needed. PGP isn't published yet. For routine support, write to support@hardtack.ai instead.
This is a coordinated-disclosure policy, not a paid bug-bounty program — but every credible report gets a personal acknowledgement and, with your permission, credit in the post-fix advisory.
In scope: app.hardtack.ai, api.hardtack.ai, hardtack.ai, the mobile driver app, and the voice-agent surface. Out of scope: social engineering, physical attacks, denial-of-service, and findings on third-party infrastructure (Twilio, Stripe, and the like) — report those to the upstream provider. A machine-readable version of this policy lives at /.well-known/security.txt.
Evaluating Hardtack and need specifics? We’ll walk you through the details.
Get in touch