Security and trust
What we do today to protect data on this website and in our work, stated plainly. If something is not listed here, we do not claim it.
Last reviewed:
Hosting and data location
- EU hosting
- This website and the data sent through its forms are hosted by Hostinger on servers in Frankfurt, Germany.
- No third-party trackers by default
- The site loads no advertising or tracking scripts. Fonts are served from our own server.
Website security
- Encrypted connections
- All pages are served over HTTPS. Browsers are told to use HTTPS only (HSTS).
- Security headers
- A content security policy, frame protection and a strict referrer policy are set for every page.
- Form protection
- Forms check where a request comes from, limit how often one address can submit, and use a hidden field to stop automated spam. IP addresses used for rate limiting are stored only as hashes and deleted after 24 hours.
Data protection
- GDPR
- We process personal data under the GDPR. The privacy policy lists what we collect, why, and for how long.
- Data minimisation
- Forms ask only for what we need to answer you. File uploads are not accepted; you can send a link instead.
AI and certification
- EU AI Act
- We follow the obligations of the EU AI Act as they apply in stages up to 2027. For client systems we can document intended purpose, data sources and tests to support your risk assessment. We do not claim conformity on anyone's behalf.
- SOC 2
- HOPn does not hold SOC 2 certification. Preparation is in progress. This page will change when an audit is complete.