Take Charge of Your Cybersecurity
We're a cybersecurity company. We hold ourselves to the same standard we hold you to.
Here is exactly how we protect your data, in plain English.
We practice what we assess
We ask you to take your cybersecurity seriously. That means you can reasonably ask: does H2Cyber take its own cybersecurity seriously?
Yes. And we can show you.
Everything you share with us (your assessment answers, your evidence documents, your firm's details) is handled with the same care we ask you to apply to your own clients' data. This page explains how, without jargon.
Where your data lives
H2Cyber's platform is hosted on Amazon Web Services (AWS) in the United States, spread across multiple availability zones. That means if one data center has a problem, your data and your access stay up. AWS targets 99.9% uptime, and our service commitments follow that.
Here is what we store on your behalf:
- Your name, username, and email address
- Your phone number
- Your billing address and payment history (invoices only, see payment security below)
- Your company name, address, and website
- Your business affiliations
- Your assessment answers and any evidence you upload
We do not store your payment card number. We use Stripe, a certified Level 1 payment processor. H2Cyber never sees your full card details.
How we protect it
- Encrypted in transit.
- Every connection between your browser and H2Cyber uses TLS (Transport Layer Security). No one can read your data in transit.
- Encrypted at rest.
- All databases and database backups are encrypted. If someone gained access to the storage, they could not read your data without the encryption key.
- Access controls.
- Your assessment data is visible only to the people and affiliations you authorize, and to the H2Cyber support staff who need it to do their job. We run on a zero-trust network model: no one gets extra access just by being on our internal network. Every employee has a unique login, and access follows the principle of least privilege (you get access to what you need for your job, and nothing more).
- DDoS and firewall protection.
- We use Cloudflare to protect against distributed denial-of-service attacks and to filter malicious traffic at the application layer. Additional firewall rules protect our database and restrict connections to known, trusted sources.
How we test our own security
We hold ourselves to the same testing standard we build the assessment around.
We conduct external penetration testing at least annually.
We perform external vulnerability scanning on a more frequent basis.
It is against H2Cyber's Terms of Service to probe, scan, or test the vulnerability of the service or any connected system without our express written consent.
Our internal program
- Written security policy.
- We maintain a Written Information Security Program (WISP) aligned to industry standards. All employees review and acknowledge it.
- Background checks.
- New employees go through background checks that include employment verification and criminal checks (for US employees), in accordance with local laws.
- Confidentiality agreements.
- Every employee signs a confidentiality agreement.
- Security awareness training.
- Employees complete security awareness training at hire and throughout the year.
- Secure development.
- Our development staff are trained in secure coding standards, including OWASP guidelines.
- Incident response.
- We have a documented Security Incident Response Plan covering identification, containment, eradication, and recovery. If you believe your account has been compromised, email incidentresponse@h2cyber.com.
- Endpoint protection.
- Our devices have encrypted hard drives and are monitored with Endpoint Detection and Response (EDR) software.
- Physical security.
- Our office uses key-fob access control, camera monitoring at entrances and exits, and an alarm system.
Third-party services we use
We share limited data with third-party service providers to handle payments, send emails, analyze site performance, and host our platform. Each provider receives only the data they need to do their specific job. We do not sell your data.
Your data, your control
- Data deletion.
- You can request deletion of all your account data by emailing legal@h2cyber.com, as long as the data is not subject to a legal hold or active investigation. Once an account is deleted, all associated data is removed and the deletion is permanent.
- Password practices.
- We enforce password complexity requirements and support multi-factor authentication (MFA). We strongly encourage you to use MFA on your account.
A few reminders for your own account
These are the basics we recommend to every client:
- Use a complex password, at least 14 characters, with uppercase, lowercase, numbers, and special characters.
- Turn on multi-factor authentication.
- Never share your password with anyone, including us. H2Cyber will never ask for your password.
- H2Cyber will never ask you to make a payment via gift card.
- Be skeptical of anyone claiming to be Microsoft or Apple who asks for remote access to your device.
- Check your login activity periodically to catch anything unusual.
Responsible disclosure
If you believe you have found a security vulnerability in H2Cyber's platform, please report it to incidentresponse@h2cyber.com. We take every report seriously and respond promptly.
Questions about security?
If you have questions about how we handle your data, email us at info@h2cyber.com or call 469-715-5255. A real person answers.