Security & Compliance at Hven

GDPR compliance

We process visitor identification data on the lawful basis of legitimate interest in B2B contact, in line with the GDPR's Recital 47.

• Lawful basis: legitimate interest for B2B contact data (Article 6(1)(f) GDPR).
• Data subject rights: access, rectification, erasure, portability, and objection — all responded to within 30 days.
• Data Processing Agreement (DPA): available on request from dpo@hven.io.
• Records of processing: we maintain a Record of Processing Activities (ROPA) per Article 30.
• DPO contact: dpo@hven.io for any data-protection enquiry.
• Supervisory authority: UK ICO (Information Commissioner's Office) is our lead authority for the UK.

Data protection

Defence in depth at every layer — transport, storage, and access.

Data location

All visitor and account data lives in the European Union and United Kingdom. We do not transfer customer data outside the EU/UK at any point in the pipeline.

• Primary region: AWS eu-west-1 (Dublin, Ireland)
• Backup region: AWS eu-west-2 (London, United Kingdom)
• CDN edge: Cloudflare with EU-only data localisation enabled
• No US transfers: the only outbound data flows are to GDPR-compliant sub-processors operating in EU/UK regions or under an adequacy decision.

Access controls

Who can do what, and how we prove it after the fact.

Tracking ethics

We're a B2B visitor intelligence product. Our tracker is built so that, even if it ran on a consumer site, it wouldn't identify individual people.

• Business visitors only. We resolve IP addresses to corporate networks via Apollo; residential and mobile-carrier IPs are dropped at ingest.
• No personal device fingerprinting. No canvas, audio, or font fingerprints. No third-party cookies. The tracker uses a single first-party identifier scoped to your domain.
• No cross-site tracking. We never join visitor records across customer domains. Each tenant's data is its own walled garden.
• ePrivacy directive compliant. Because identification uses IP-to-company lookup rather than cookies, the tracker doesn't require the pre-consent cookie banner under ePrivacy / PECR.
• Honours Do Not Track. Visitors with the DNT: 1 header are silently dropped at ingest.

Apollo data & outreach contacts

When you use the Hot Visitor Outreach feature, we look up decision-maker contact data via Apollo.io. Here's exactly what that means.

• Public B2B contact data only. Apollo's contact database is sourced from public business profiles — LinkedIn-style professional information, not personal data.
• Apollo is a GDPR-compliant data processor. They publish a DPA and operate under the GDPR's legitimate-interest basis for B2B sales prospecting.
• No personal email addresses. We surface work email addresses for contacts in their professional capacity. Personal-domain emails (gmail, hotmail) are filtered out at the API layer.
• Decision-makers only. Outreach only enriches contacts with Director-level or higher seniority titles, and only for the company that hit your site.
• Right to opt out. Contacts who email dpo@hven.io with a removal request are added to a global opt-out list within 24 hours.

Certifications & roadmap

What we have, and what we're working towards.

Vulnerability reporting

Found a security issue? Tell us privately so we can fix it.

• Email: security@hven.io
• PGP key: www.hven.io/.well-known/pgp-key.txt (fingerprint published; encrypted submissions welcomed)
• Response SLA: we acknowledge within 24 hours and provide a fix ETA within 5 business days for valid reports.
• Bug bounty: coming soon — sign up to be notified at security@hven.io.
• Safe harbour: good-faith research conducted under our disclosure policy will not result in legal action.

Sub-processors

The third-party services that help us deliver Hven, and what each one handles. Each operates under its own DPA and GDPR-compliant terms.

We notify customers at least 30 days in advance of any new sub-processor. Subscribe to sub-processor updates to be notified.