Security

Hoppla processes monitoring data for websites and infrastructure you depend on. We treat the security of your data with the same seriousness you bring to running your own systems. This page describes how we protect your account, your monitoring data, and our platform.

At a glance

Infrastructure Security

• Hosting: Hetzner Cloud (Falkenstein, Germany + Helsinki, Finland) — ISO 27001 certified data centers
• Orchestration: Kubernetes with network policies isolating services
• Database: PostgreSQL 16 + TimescaleDB; volumes encrypted at rest by Hetzner under the provider's keys
• Cache / Queue: Redis with authentication, no public network exposure
• CDN / DDoS: Cloudflare for edge protection and TLS termination
• Secrets: Kubernetes Secrets with encryption at rest, injected at deploy time; every CI run scans the repository for committed credentials (gitleaks)

Encryption

• In transit: TLS 1.3 enforced on all Hoppla domains; TLS 1.2 minimum for custom status page domains
• At rest: database volumes and backup objects are encrypted at rest by our infrastructure provider (Hetzner) under the provider's keys — Hoppla does not operate its own volume-level encryption
• Sensitive fields: 2FA secrets and recovery codes are application-level encrypted (AES-256-CBC)
• Passwords: bcrypt with cost factor 12 — never stored in plaintext

Application Security

• Multi-tenancy: PostgreSQL Row-Level Security (RLS) enforces per-tenant data isolation at the database engine level, not via application WHERE clauses
• Input validation: server-side validation on every endpoint; parameterized queries (no raw SQL interpolation)
• Rate limiting: per-route and per-user rate limits on all API endpoints, with stricter limits on auth and MFA endpoints
• CSRF protection: double-submit cookie pattern on all state-changing requests
• Dependency management: dependency vulnerability audit in the CI pipeline; critical patches applied promptly
• No tracking: no analytics, no advertising pixels, no cross-site tracking cookies, and fonts served from our own domain. Two external scripts load on specific pages only: Cloudflare Turnstile as spam protection on form pages, and Paddle.js on the checkout page.

Authentication & Access Control

• MFA: TOTP authenticator apps, WebAuthn/Passkeys, and recovery codes
• Passkey login: passwordless authentication via platform authenticators
• API tokens: scoped personal access tokens with optional expiration dates
• Session management: HTTP-only secure cookies; sessions invalidated on password change
• Role-based access: admin, operator, member and viewer roles per team
• SSO: OIDC single sign-on and partner SSO for managed teams

Data Handling

• Collection: we collect only what is needed to run the monitoring service — account info, monitoring targets, check results, notification settings
• Retention: check results retained per plan (7–365 days on customer plans, 730 days on reseller plans); notification logs: 90 days; audit logs: 1 year; sessions: purged on expiry
• Export: full data export as JSON from Settings > Data & Privacy (GDPR Art. 20)
• Deletion: self-service account deletion removes your login at once; a team with no other members is permanently purged 30 days later
• Backups: daily offsite backups to EU object storage (Hetzner, Falkenstein) with 14-day retention, encrypted at rest under the provider's keys

Full details: Privacy Policy · Data Processing Agreement · Sub-Processors

Availability & Reliability

• Status page: status.hoppla.dev — real-time platform health
• Dual-check verification: failed HTTP uptime checks are re-tested from a second probe location before an incident opens
• Two EU probe locations: checks run from Germany; Helsinki, Finland, re-tests failed HTTP uptime checks
• Queue architecture: Redis Streams with per-check-type worker pools — a spike in one check type does not affect others
• Disaster recovery: restore from the daily offsite backup — recovery point up to 24 hours, documented recovery procedures. We do not currently operate automated database failover.

Audit Logging

• All administrative actions (monitor changes, team membership, settings, API token management) are recorded with user, timestamp, and diff
• Security events (login, password change, MFA changes, data export, account deletion) logged to a dedicated security channel
• Audit logs are viewable in the dashboard and included in data exports
• Logs retained for 1 year, then automatically purged

Incident Response

• Documented incident response process with severity classification (P1–P4)
• Affected customers are notified without undue delay, at the latest within 48 hours, so they can meet their own 72-hour duty under GDPR Art. 33 (DPA § 6)
• Post-incident reviews conducted for all P1/P2 incidents
• Security incidents reported to: [email protected]

Responsible Disclosure

If you discover a security vulnerability in Hoppla, we appreciate your help in disclosing it responsibly.

• Report to: [email protected]
• What to include: description of the vulnerability, steps to reproduce, potential impact
• Our commitment: we will acknowledge receipt within 2 business days and provide a substantive response within 5 business days
• Safe harbor: we will not pursue legal action against researchers who report vulnerabilities in good faith and follow responsible disclosure practices

Compliance

We are a young company and do not yet hold SOC 2 or ISO 27001 certifications. We are committed to security best practices and will pursue formal certifications as we grow. If you have specific compliance questions, reach out to [email protected].

Questions?

Security: [email protected]
Privacy: [email protected]
General: [email protected]