Security, compliance, and data handling.
We'd rather lose a deal than overstate our posture in a questionnaire. This page is the source of truth for what we ship today, what's on the roadmap, and how we'll handle your data under contract.
Last reviewed: April 2026
Available now
These controls are in production and verifiable in a pilot.
Transport encryption (TLS 1.2+)
All traffic terminates at Google Cloud Load Balancer / Vercel Edge with HSTS enforced.
At-rest encryption (AES-256)
Firestore + Cloud Storage data is encrypted at rest by default via Google-managed keys.
Per-user authentication
Firebase Auth with email, Google, and Apple Sign-In. Passwords hashed with scrypt.
Role-based access controls
Circles, products, and admin actions are gated by per-user RBAC enforced in Firestore Security Rules and server actions.
Audit logging
Admin actions and product-state transitions are written to an immutable audit log (Firestore `auditLogs`).
Data export and erasure
Self-service export (JSON) and right-to-erasure endpoints. Both available via the in-app Account → Privacy panel and via API.
US-region data residency
Primary data store is Firebase in us-central1; backups stay in US multi-region.
Vendor offboarding playbook
Documented in docs/SECURITY.md — covers data return / deletion timelines on contract termination.
Coming next
Tracked publicly. We publish when we hit dates and when we slip.
SAML / OIDC SSO via WorkOS
Q3 2026Okta, Azure AD, Google Workspace, OneLogin, JumpCloud. Required for any production deployment > 100 seats.
SOC 2 Type 1
Q3 2026Engagement with Vanta / Drata for continuous monitoring; audit firm selected in May 2026.
SCIM 2.0 directory provisioning
Q4 2026Just-in-time + scheduled user lifecycle management via WorkOS Directory.
Enterprise admin console
Q4 2026Org-level reporting, policy controls (retention, sharing, public-profile defaults), session management.
SOC 2 Type 2 observation window
H1 20276-month observation following Type 1 attestation.
Customer-managed encryption keys (CMEK)
H1 2027For tier-1 contracts that require key custody outside Hustlin's cloud account.
Regional residency options
H2 2027EU and CA residency for customers with data-localization requirements.
Data handling
Where data lives
Primary store: Google Firestore (us-central1). File and image assets: Google Cloud Storage (us-central1). LLM inference is stateless — no customer data is used for vendor model training (zero data retention is enabled where the provider supports it).
Retention
Customer data is retained for the term of the contract. On termination, customer data is deleted within 30 days (or returned as JSON / NDJSON export on request). Audit logs and billing records are retained for 7 years.
Incident response
Security incidents are triaged in PagerDuty (24×7 on-call). Customers are notified within 72 hours of a confirmed incident affecting their data, with a written post-mortem and remediation plan inside 14 days.
Report a vulnerability
Email security@hustlin.ai with reproduction steps. We acknowledge inside 1 business day and aim to remediate critical issues inside 7 days. Responsible-disclosure researchers are credited on request.
Sub-processors
The third parties that may process customer data in the course of providing Hustlin. Updates to this list are announced at least 30 days before they take effect.
| Vendor | Purpose | Region |
|---|---|---|
| Google Cloud Platform (Firebase, Firestore, Cloud Functions) | Primary application infrastructure, database, file storage | us-central1 |
| Vercel | Next.js hosting and edge runtime | US (multi-region) |
| OpenAI / Anthropic / Google Gemini | LLM inference for product scoring, AI assistance, and content generation | US |
| SendGrid | Transactional email (account, invitations, notifications) | US |
| Stripe | Billing and subscription management | US |
| Sentry | Application error monitoring (no PII in events) | US |
| Browserbase | Headless browser automation for content publishing workflows | US |
What we'll sign
DPA
MSA
Security questionnaire
Need more detail?
We share our full security overview, sub-processor list, and SOC 2 readiness roadmap with prospective customers under NDA.