Trust Center
Welcome to Hupo's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation.
We maintain a SOC 2 Type II attestation covering Security, Availability and Confidentiality, audited annually by an independent CPA firm and monitored continuously between audits. Client data is hosted in Singapore by default, encrypted in transit and at rest, and logically isolated per client. Voice and audio are never persistently stored. No AI provider retains, logs, or trains on client data, and our AI systems are governed by a formal risk assessment structured against ISO/IEC 42001.
The sections below set out the controls behind those commitments. Our SOC 2 report, penetration test summary, and supporting documentation are available on request.
Data Privacy
Privacy of customer data is top of mind. We follow industry best practices and follow all applicable privacy regulations.
Endpoint Security
We follow industry best practices for endpoint security. We are happy to provide more details about our endpoint security practices upon request.
Network Security
We protect our corporate network against external & internal threats.
Corporate Security
We implement internal measures and practices to maintain a high standard of security.
Policies
We are currently working with experts to put together our company policies. Please contact us for more details.
Security Grades
We are constantly monitoring the security of our website. We will post our grades from public security rating agencies when they become available.
Incident Response
We have a dedicated team that responds to security incidents. We are happy to provide more details about our incident response practices upon request.
Risk Management
We have a dedicated team that manages security risks. We are happy to provide more details about our risk management practices upon request.
Asset Management
We have strict asset management policies in place to ensure that all assets are accounted for and secure.
BC/DR
We have a business continuity plan in place to ensure that we can continue to operate in the event of a disaster.
Training
We provide security awareness training to all employees to ensure that they are aware of security best practices.
Physical & Environment
We have physical and environmental controls in place to ensure that our data centers are secure and reliable.
Continuous Monitoring
We continuously monitor our systems for security threats and vulnerabilities. We are happy to provide more details about our continuous monitoring practices upon request.
- How is client data encrypted?
- Is our data segregated from other clients' data?
- Which sub-processors have access to client data?
- How quickly will we be notified of a security incident?
- How long is data retained, and what happens when we terminate?
Trust Center Updates
PHP2Shell (CVE-2026-109618 / CVE-2026-109619): Hupo is not affected
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities, known as PHP2Shell, that can allow unauthenticated remote code execution.
Hupo is not affected. Our platform does not use PHP. Our engineering team has reviewed our container images, source code repositories, hosting environments and public website and confirmed that PHP is not present.
No action is required from customers for the Hupo services. We have found no evidence of exploitation related to these vulnerabilities in our environment.
We continue to monitor advisories from our third-party service providers and will notify affected customers promptly if anything changes.