Security at Habyn

Habyn is the system of record for properties, leases, and the people who rely on them. Security isn't a feature - it's the foundation.

Encryption

All traffic to Habyn is encrypted in transit with TLS 1.2 or higher. Customer data at rest is encrypted with AES-256 on managed cloud storage. Secrets and credentials are kept in a dedicated secret store, never in source code.

Infrastructure

Habyn runs on managed cloud infrastructure with primary hosting in North America. Applications are served on Vercel's edge network, which provides TLS termination and DDoS protection. Databases run in high-availability mode with point-in-time recovery and encrypted automated backups.

Authentication and access

User authentication uses industry-standard practices: password hashing with strong algorithms, secure session handling, and support for OAuth-based sign-in. Internal access to production is restricted to a small number of authorized engineers, follows least-privilege principles, and is logged and reviewed.

Tenant isolation

Customer data is logically isolated per organization. Every request is authorized server-side against the owning resource before any data is read or written, so access is proven per request rather than assumed from a session or a client-supplied identifier. Cross-tenant access tests are a required check in our pipeline: a change that would let one customer reach another's data fails the build before it can merge.

Application security

• Code review on every change before merge.
• Automated dependency scanning and timely patching of vulnerabilities.
• Input validation, output encoding, and CSRF protection on all state-changing endpoints.
• Rate limiting and abuse detection on public endpoints.

Compliance status

We are actively working toward SOC 2 Type II readiness. We are not yet certified. If your organization requires a security questionnaire or DPA before adoption, contact us and we'll work through it.

Incident response

We monitor production 24/7 with alerting on integrity, availability, and unusual access patterns. In the event of a security incident affecting customer data, we will notify affected customers without undue delay (and within any window required by applicable law) with details, scope, and remediation steps.

Responsible disclosure

We welcome security research. If you believe you've found a vulnerability, please email privacyofficer@habyn.ai with a description and reproduction steps. Please give us a reasonable window to remediate before public disclosure. We will acknowledge your report and keep you updated through resolution.

Contact

Security questions: privacyofficer@habyn.ai