Security · Huttenlocher TechnologiesBuilt like we expect to be audited.
Every control here is checked by a machine, every week.
We build websites, client portals and payment systems for other businesses, and we run two platforms of our own that strangers trust with their nights and their weddings. So we run the company to the SOC 2 Trust Services Criteria, keep the evidence, and publish what we do here. No security theater; what is on this page is what is running.
The controls, in plain words.
Encryption everywhere
HTTPS with HSTS on every site and app. SSL enforced on every database connection. Secrets live in the hosting provider's encrypted environment, never in the code.
Two-step sign-in for anyone with power
Every administrator must enroll an authenticator app before the portal opens for them. Clients and their teammates can turn it on, and we ask them to. Passwords are checked against known breaches.
Access enforced by the database, not just the app
Row level security on every table: a client can only ever read their own rows, and the anonymous internet can read nothing. Server-only tables have no grants at all. A weekly job proves it is still true.
Records that cannot be quietly changed
Every admin action writes an append-only audit log that even our own server cannot edit or delete. Every signed document carries a hash-chained trail and a certificate of completion you can verify.
Uploads checked by content
Files are identified by what is inside them, not their name, size-limited, and kept in private storage behind short-lived signed links.
Dependencies and code checked weekly
Automated vulnerability audits and a full typecheck run on every change and every Monday. Critical advisories are patched within seven days.
A written incident plan, exercised
Contain, preserve evidence, recover, report. It is the same plan we sell as incident response, so it gets used on real incidents, not just read.
Backups, and people who know where things are
Daily database backups with a rolling week of history, code in version control with full history, and a continuity plan for the day the founder is unreachable.
Our providers, and their reports.
We do not run servers. These companies do, and each publishes its own independent security report.
Vercel
Hosting, builds, secrets
Supabase
Database, sign-in, file storage
Stripe
Payments. Card data never touches us.
Resend
Transactional email
GitHub
Source control and CI
Google Workspace
Company email
Straight answers.
Are you SOC 2 certified?
Not yet. We run our systems and our program to the SOC 2 Trust Services Criteria (security, availability, confidentiality, processing integrity) and collect the evidence every week, so an audit is a matter of scheduling one, not of changing how we work. If a client needs the report itself, we will tell you plainly where we stand.
Where is my data stored?
In the United States, with providers that publish their own SOC 2 reports: hosting and builds on Vercel, database, authentication and file storage on Supabase, payments on Stripe, email on Resend, code on GitHub. Card and bank details never touch our systems; Stripe holds them.
Who can see my files and documents?
The people on your account and the founder. Files live in private storage and are served through signed links that expire; the database enforces that rule on every row, not just the app. Our contractors do not have access to client accounts.
Can I get my data deleted?
Yes. Ask, and it is done within 30 days, except records the law makes us keep (invoices for tax, for example), and we tell you which those are.
What happens if there is a breach?
We contain it first, preserve the evidence, recover, and write it up. Anyone whose data was affected hears from us in writing within 72 hours of our knowing, with what happened and what changed.
How do I report a security problem?
Email nikita@huttenlochertech.com. You get a reply within two business days and a note when it is fixed. We do not pursue people who report in good faith.
Report a security problem: nikita@huttenlochertech.com · Huttenlocher Technologies LLC, Myrtle Beach, SC