How we protect your code

• Backups need only Contents: read and Metadata: read. hailm.io cannot push, delete or change settings in your GitHub organization.
• When you add a token, we check it with GitHub and reject tokens that can write (classic tokens with write scopes).
• Write access is needed only to restore by push. It is given for that restore alone and is not kept afterwards.

• Your token is stored in AWS Secrets Manager, encrypted with AWS KMS, in an AWS account dedicated to hailm.io.
• Our web application can store a token but never read it back. The interface shows only its last 4 characters, its expiry and when it was last used.
• Only a credential service hands a token to a backup machine, and only to the machine running your workspace's current backup. It checks the machine's identity with AWS on every request.
• On the backup machine the token lives in memory for the length of the run. It is never written to disk.
• Slack and Teams webhook addresses you add for alerts are encrypted in our database and shown only by their last 4 characters.

• Every backup runs on a fresh machine started for your workspace alone, never shared with another customer, and destroyed when the run ends.
• Backup machines sit in a private network with no inbound access. They reach GitHub through a fixed address you can add to an allow-list.
• Backup machines cannot reach our application database and cannot read any secret directly.
• Every repository is checked with git fsck, and each run records a manifest of branches, tags, commits and sizes.

• Each restore point is an encrypted disk snapshot, encrypted with KMS keys dedicated to your workspace, one in each region.
• Each restore point is copied to a second AWS region (us-east-1 and us-west-2).
• Restore points are locked against deletion for the retention period. The lock can only be lifted by a tightly restricted administrative permission; we are moving to compliance-mode locks, which nobody can lift, including us.
• Your keys are protected against deletion: only a break-glass role can request it, with a 30-day waiting period that is longer than the retention, and any attempt raises an alert.
• Backup disks are mounted without permission to run programs, and restores mount them read-only.

• Sign-in is handled by Clerk. Workspace roles (owner, admin, viewer) limit who can change settings or credentials.
• An append-only audit log records sign-ins, token changes, backups, settings changes and restores. You can filter it and export it as CSV.
• All traffic to hailm.io uses TLS. Our infrastructure is defined as code and runs in a dedicated AWS account with CloudTrail enabled.

On our roadmap

• Mandatory multi-factor sign-in before a restore or a credential change.
• Single sign-on (SAML/OIDC) for enterprise workspaces.

Where we are: hailm.io does not yet hold a SOC 2 or ISO 27001 certification. We design to those controls and will publish our progress here. We are happy to complete your security questionnaire and walk your team through our architecture.

Evidence you can use for your own audits

• Audit log export (CSV) of every backup, sign-in and change in your workspace.
• A manifest for every run: each repository, its last commit, size, LFS objects and integrity check.
• The lock status and expiry of every restore point, shown on your dashboard.

Your data

• Location: AWS us-east-1 (N. Virginia), with the second copy in us-west-2 (Oregon).
• Retention: 7 days of daily restore points, enforced by the lock. Older restore points are deleted automatically.
• Leaving: when you cancel, backups stop, the remaining restore points expire with their locks (at most 7 days), and your workspace keys are then scheduled for deletion.
• Service providers: Amazon Web Services (hosting and storage), Clerk (sign-in), GitHub (the source we back up), Cloudflare (DNS). Slack or Microsoft Teams only if you connect them.
• A data processing agreement (DPA) is available on request.

If you believe you have found a security issue in hailm.io, please tell us through the contact form and choose "A question". Include the steps to reproduce it. We will acknowledge your report, keep you updated, and credit you if you wish. Please do not access other customers' data or disrupt the service while testing.