Web Hosting Trust & Security Center

Purpose and scope

Security depends on the actual service, architecture, location, workload, threat model, and customer configuration. We confirm those facts in a written order instead of treating broad marketing language as a technical specification. If a specific control is essential, ask us to identify it in the order before placing regulated or high-risk data in the service.

The current public website includes a server-side quote endpoint. It validates the published quote fields, rejects likely payment-card and account data before storage, creates cryptographic request and client-IP pseudonyms for idempotency and abuse controls, and stores an accepted inquiry in Cloudflare D1 before Resend attempts delivery to the configured business mailbox. The configured mail provider may retain or forward the delivered message under its account settings.

Termly's resource blocker and consent interface run at the browser level and may use necessary cookies or storage to apply a consent choice. The site is not deliberately configured with analytics, advertising trackers, chat, account login, or a payment SDK. Infrastructure request and security logs may still be created when the site is accessed.

Our security commitments

We apply controls in proportion to the service and risk. Our program is guided by the commitments below.

Area	Our commitment
Data minimization	Limit collection and access to what is reasonably needed for the website, customer relationship, ordered service, security, and legal duties.
Access	Restrict administrative access according to role and need, manage access changes, and use authentication appropriate to the system's risk.
System lifecycle	Evaluate security when introducing or materially changing a service, manage relevant vulnerabilities and updates based on risk, and retire access or data when no longer needed.
Protection in transit	Use supported encrypted transport for public and administrative connections where appropriate, and document any workload-specific requirement in the order.
Detection and response	Maintain ways to receive reports, investigate credible security events, contain and recover based on impact, and make notices required by law or agreement.
Service continuity	Plan for service recovery in proportion to the service. Backup, replication, recovery objectives, and remedies apply only when the relevant order says they do.
Third-party risk	Consider the role and risk of providers used to deliver a service and place appropriate contractual or technical boundaries around their access.

A control's design and implementation can change as threats, technology, and services evolve. If a change materially alters a contractual commitment, the agreement's change process controls.

Confirm the service boundary

A hosting label does not by itself identify who operates the hardware, where every copy of data resides, which network paths are used, or which backup and support features are included. Those details must be confirmed for the purchased configuration. Statements about possible locations or capabilities on the public site are choices to discuss, not proof that a particular resource has been provisioned.

Before ordering, customers with specific requirements should confirm:

the service components and responsibilities in scope;
approved workload and data categories;
service and data-location requirements;
access, encryption, logging, backup, and recovery requirements;
support, incident-notice, and availability commitments; and
any required data-processing or sector-specific terms.

Do not assume a feature, subprocessor restriction, residency promise, or regulated-workload commitment exists unless the applicable written agreement confirms it.

Security is shared

We are responsible for the parts of an ordered service assigned to us. Customers remain responsible for their applications, code, users, credentials, permissions, content, configurations, endpoints, and lawful use unless the order expressly moves a responsibility to us.

HYPERHOSTGATE	Customer
Operate the contracted service components in our scope	Choose an appropriate service and configure it securely
Protect our administrative access to in-scope systems	Protect account credentials, access keys, devices, and user permissions
Address issues in infrastructure assigned to us	Maintain customer code, dependencies, applications, and data handling
Communicate incidents as required by the agreement or law	Report suspected compromise promptly and preserve relevant evidence

Customers should use least privilege, strong and unique credentials, supported software, appropriate network restrictions, tested recovery procedures, and monitoring suited to their workload. Security options are effective only when configured and maintained correctly.

Incident response and communication

We commit to maintain a channel for security reports; assess credible events; prioritize containment, investigation, remediation, and recovery according to risk; and document material decisions. We will notify affected customers or authorities in the manner and time required by applicable law and the relevant agreement.

An operational alert is not automatically a personal-data breach, and an incident affecting one service does not necessarily affect every customer. Initial notices may be incomplete while an investigation is active. We will distinguish confirmed facts from preliminary findings and provide appropriate updates when required.

Customers must maintain current contacts and tell us promptly about suspected unauthorized access, exposed credentials, unexpected traffic, or other evidence relevant to an ordered service.

Assurance and certification status

If your procurement or compliance process requires an audit report, certification, penetration-test summary, data-processing addendum, or detailed control response, ask before ordering. We will confirm in writing what information is available, what confidentiality terms apply, and whether the requested framework or document is relevant to the proposed service.

PCI DSS applies to environments that store, process, or transmit payment-card data and to connected systems within scope. The public site does not collect card data or embed a payment SDK. That fact does not make a customer workload PCI compliant. A customer considering card data must establish scope with qualified advisers and obtain our written confirmation before using a service for that workload.

Privacy laws such as GDPR are legal regimes, not product certifications. Our Privacy Policyexplains our roles and conditional rights without representing that a regulator has approved our practices.

Report a security issue

Send the affected hostname or service, a clear description, reproduction steps, approximate time, and supporting evidence. Remove credentials and unnecessary personal information. Do not include live secrets in ordinary email; first ask us to arrange an appropriate transfer method if sensitive evidence is essential.

Do not disrupt services, access data beyond what is necessary to demonstrate a suspected issue, use social engineering, degrade availability, or test customer systems without written authorization. This page does not create a bug-bounty reward, safe-harbor promise, or authorization to test systems.