Trust Center

Operational Last updated:

Transparent, secure, and compliance-first autonomous security.

SelfHack is an enterprise-grade, compliance-first AI-driven penetration testing platform designed for regulated industries. Built on EU-based infrastructure with globally scalable data residency (EU / EEA / US), SelfHack delivers continuous and autonomous security, combining AI-powered execution with human-validated results.

  • EU-based, globally scalable data infrastructure (EU / EEA / US)
  • Enterprise-grade AI security
  • Compliance-first autonomous pentesting
  • Continuous & always-on security
  • Human-validated AI findings
  • Not a scanner
  • Designed for regulated industries (finance, telecom, government)
99.9%
Platform Uptime
EU Default
Data Residency
AES-256
Encryption
24/7
Monitoring
Request Security Docs

Certifications & Memberships

Recognized standards and ecosystem partnerships

Certification / Membership Description Status
ECSO Cybersecurity Label
European cybersecurity quality label Verified
Finnish Information Security Cluster (FISC)
Finnish cybersecurity ecosystem membership Member
NVIDIA Inception Program
AI startup acceleration program I. Startup
GDPR Compliance
Policy-backed GDPR alignment Compliant

Where applicable, official references or confirmations are provided. Additional verification is available upon request.

Security Practices

Comprehensive security controls and operational practices

3.1 Data Encryption

At Rest

  • AES-256 encryption for all data at rest
  • Applies to databases, object storage, logs, and AI interaction records
  • Cloud-native encryption mechanisms
  • Controlled key management

In Transit

  • TLS 1.3 for all data in transit
  • User access, API traffic, and internal service-to-service communication

Data Integrity

  • SHA-512 hashing for data integrity verification
  • Tamper-resistant security and audit logs
  • Integrity controls for AI execution traces and audit data

3.2 Access Control

Authentication

  • Mandatory MFA for internal users and customers
  • Password policies aligned with globally recognized security frameworks
  • Scoped API access tokens

Authorization

  • Role-Based Access Control (RBAC)
  • Supports Admin, Security Engineer, Read-only/Auditor roles
  • Granular permissions

Enterprise Identity

  • Enterprise SSO (SAML/OIDC) on roadmap
  • Can be enabled for regulated customers upon request

Session Security

  • Automatic session timeout
  • IP-based anomaly detection
  • Concurrent session limits
  • Full session logging

3.3 Network Security

Connectivity

  • Site-to-site IPSec VPN
  • Private networking/VPC peering
  • Restricted public exposure by default

Perimeter & Application

  • WAF for web and APIs
  • Geo-blocking capabilities
  • Network segmentation
  • Centralized internal logging system

Availability

  • Cloud-native DDoS protection (Cloudflare)
  • Rate limiting
  • Auto-scaling under attack conditions

3.4 AI/ML Security

Customer Data & AI

  • Customer data never used for model training
  • Dedicated/isolated model usage
  • Prompt/response isolation between tenants

AI Interaction Logging

  • All AI actions logged
  • Full prompt→decision→output traceability
  • Audit trails available upon request

Agentic Security Layer

  • Internal AI agents analyze platform/security logs
  • Automated anomaly detection with escalation
  • Human-in-the-loop validation
Evidence available upon request under NDA

3.5 Operational Security

Third-Party Pentesting

  • Annual third-party penetration testing
  • Scope includes platform, infrastructure, and APIs
  • Executive summaries available upon request under NDA via [email protected]

Continuous Security

  • Continuous vulnerability scanning
  • Patch/update management
  • Secure SDLC
  • SelfHack continuously tests its own platform

Monitoring & Incident Response

  • 24/7 infrastructure and security monitoring
  • Internal monitoring and response
  • Documented incident response playbooks
Evidence available upon request under NDA

3.6 Compliance & Auditability

Compliance

  • GDPR compliant
  • ISO 27001-aligned controls (in progress)
  • SOC 2-aligned controls (in progress)
  • NIS2 readiness (in progress)

Customer Audits

  • Audit support upon request
  • Evidence sharing under NDA
  • Support for customer security questionnaires

Data Residency Controls

  • Customer-selected region
  • EU-only enforcement available
  • Contractual guarantees via DPA
Evidence available upon request under NDA

Infrastructure

Trusted cloud providers with region-controlled deployments

AWS
  • Mixed workloads (compute, storage, networking, AI)
  • Region selectable per customer (EU default, optional non-EU)
Hetzner Cloud
  • Mixed usage
  • Customer-specific isolated environments
  • EU-based deployments

Controls

Tenant isolation
Environment separation (prod/staging/test)
Network segmentation
Least-privilege access
MFA for infrastructure access
Access logging & audit trails
Time-bound, approval-based access

Third-Party Services

Noux Contract and NDA signing
HubSpot Ticketing and email communication
Slack Team communication
Notion Documentation and knowledge base
SelfHack operates on trusted cloud infrastructure providers with region-controlled deployments, strong tenant isolation, and security-first architecture.

Security Documents

Access our security documentation and policies

Most security documentation is provided upon request under NDA.
Document Access Format Action
Third-party penetration test summaries NDA PDF Request via email
High-level architecture overview NDA PDF Request via email
SOC & monitoring overview NDA PDF Request via email
Risk and control mappings NDA PDF Request via email
Privacy Policy Public PDF View
Terms of Service Public PDF View
Data Processing Agreement (DPA) Public PDF View
Subprocessor List Public PDF View

Request Process

Document Governance

  • Last updated date tracked for all documents
  • Reviewed annually
  • Major changes tracked

Frequently Asked Questions

Common questions about our security practices

Is SelfHack a vulnerability scanner?
No. SelfHack is an AI-driven penetration testing platform, not a vulnerability scanner. We combine AI-powered execution with human-validated results to deliver comprehensive, enterprise-grade security assessments that go beyond automated scanning.
Do you train AI models on customer data?
No. Customer data is never used for model training. We maintain dedicated/isolated model usage with prompt/response isolation between tenants to ensure complete data separation.
Can we enforce EU-only data residency?
Yes. Data residency is customer-selected. EU-only enforcement is available and can be contractually guaranteed via our Data Processing Agreement (DPA).
Do you support private connectivity?
Yes. We support site-to-site IPSec VPN and private networking/VPC peering. Public exposure is restricted by default.
How can we access security documents?
Most security documentation is provided upon request under NDA. Contact [email protected] with your request. Public documents such as our Privacy Policy, Terms of Service, DPA, and Subprocessor List are available directly on our website.
Do you support customer audits?
Yes. We provide audit support upon request, evidence sharing under NDA, and support for customer security questionnaires. Contact us to discuss your specific audit requirements.

Contact Security Team

Have questions about our security practices?

[email protected]

We typically respond within business days.

Send Email