Security at humanOS
Your data powers your optimization — and protecting it is our highest priority. Enterprise-grade security built into every layer of the platform.
Our Commitment
Security isn't a feature — it's the foundation everything else is built on.
humanOS processes some of the most personal data imaginable — your daily schedules, energy patterns, goals, health metrics, and life priorities. We understand the weight of that responsibility.
Our security program is designed around the principle of defense in depth: multiple overlapping layers of protection so that no single point of failure can compromise your data. From the way we encrypt your information, to how our AI models process it, to how our team accesses infrastructure — every decision is made with security as the primary consideration.
We hold ourselves to the same standards expected of enterprise software, because your personal data deserves nothing less.
Data Encryption
Your data is encrypted at every stage — in motion and at rest.
Encryption in Transit
All data transmitted between your device and our servers is protected using the latest security protocols.
- TLS 1.3 for all connections — older protocols are disabled
- HTTP Strict Transport Security (HSTS) enforced
- Perfect Forward Secrecy (PFS) ensuring past sessions stay protected
Encryption at Rest
All stored data — including your schedules, preferences, and AI models — is encrypted using industry-leading standards.
- AES-256 encryption for all database records and file storage
Infrastructure Security
Built on battle-tested cloud infrastructure with multiple layers of protection.
Cloud Infrastructure
Hosted on SOC 2 Type II compliant cloud providers with ISO 27001 certification, physical security controls, and 24/7 monitoring.
High Availability
We rely on our infrastructure providers' redundancy and failover. We do not offer an uptime SLA.
Database Security
Database connections are encrypted in transit (TLS), and all queries are parameterized to prevent SQL injection.
Logging & Monitoring
Application logs capture activity across the platform. Real-time alerting and anomaly detection are on the roadmap and not yet in place.
Disaster Recovery
Our database provider offers point-in-time recovery. We have not yet run or verified a full disaster-recovery drill; that testing is planned but not yet complete.
Authentication & Access Control
Multiple layers of identity verification and access management protect your account.
User Authentication
Secure Password Handling
Passwords are hashed using bcrypt with unique salts. We never store plaintext passwords and enforce minimum complexity requirements.
JWT Session Management
Sessions are managed via signed JWT tokens with short expiry (24 hours), stored in httpOnly secure cookies to prevent XSS theft.
Multi-Factor Authentication
MFA support via authenticator apps (TOTP) adds a second layer of protection beyond your password. Available on all plan tiers.
Session Controls
View active sessions, revoke access from any device, and receive alerts for sign-ins from unrecognized locations or devices.
Internal Access Control
Principle of Least Privilege
Team members only have access to the systems and data necessary for their role.
Role-Based Access Control (RBAC)
Granular permissions ensure that engineering, support, and operations teams have appropriate but limited access scopes.
Audit Trail
Every access to production systems and user data is logged with timestamps, action details, and the identity of the accessor.
AI Model Security
How your data is handled within our AI processing pipeline — with isolation and privacy at every step.
Per-User Data Isolation
Your personal optimization model is completely isolated from other users. No user can access or influence another user's data or AI recommendations.
No Cross-User Training
Your individual data is never used to train AI models for other users. Only fully anonymized, aggregated data (which cannot be linked back to you) may be used to improve platform-wide algorithms.
Secure Processing Environment
AI model inference runs in isolated compute environments with no persistent storage of intermediate results. Processing data is discarded after recommendations are generated.
Input Validation & Sanitization
All data entering AI processing pipelines is validated and sanitized to prevent prompt injection, data poisoning, and other AI-specific attack vectors.
Model Versioning & Rollback
AI models are versioned and monitored for accuracy and safety. If anomalies are detected, we can immediately roll back to a previous stable version.
Audits & Compliance
Regular testing, industry certifications, and regulatory compliance keep our security posture strong.
Security Testing
Vulnerability Scanning
Automated scanning runs continuously across our application and infrastructure, with critical findings addressed within 24 hours.
Code Reviews
Every change is typechecked, linted and tested in CI before merge. We do not yet have mandatory peer review or branch protection enforcing it.
Dependency Auditing
Third-party dependencies are continuously monitored for known vulnerabilities and updated promptly.
Certifications & Compliance
SOC 2 Type II
Our infrastructure providers maintain SOC 2 Type II certification. humanOS is pursuing its own SOC 2 certification.
GDPR
We are aligning with the EU General Data Protection Regulation. Self-service data subject rights (access, export, erasure) are not built yet; we honor those requests manually at privacy@humanos.ai while the tools are being built.
CCPA
We do not sell personal data, and never have. Self-service tools for the rights to know and to delete are in progress; until they ship, we handle requests manually at privacy@humanos.ai.
OWASP Top 10
Our development practices are aligned with OWASP guidelines to protect against the most critical web application security risks.
Incident Response
A clear, tested plan for detecting, containing, and communicating security incidents.
Detection & Triage
Errors and anomalies surface through platform logs and our infrastructure providers’ monitoring. Dedicated alerting and a formal on-call rotation are on the roadmap and not yet in place, so detection today is human and best-effort.
Containment
The incident response team isolates affected systems to prevent further impact. Affected services are secured before investigation proceeds.
Investigation & Resolution
Root cause analysis identifies the source and scope of the incident. Fixes are developed, tested, and deployed with urgency proportional to severity.
Notification
If a breach affects your data, we will tell you without undue delay and notify regulators within the windows the law requires, with clear details about what happened and what to do. (GDPR’s 72-hour clock applies to notifying the supervisory authority; we will not sit on news that concerns you.)
Post-Incident Review
Every incident results in a post-mortem review. Findings are documented, preventive measures are implemented, and the incident response plan is updated accordingly.
Responsible Disclosure
We welcome security researchers who help us keep humanOS safe.
If you discover a security vulnerability in humanOS, we ask that you disclose it responsibly by contacting us at security@humanos.ai. Please include:
- A detailed description of the vulnerability and its potential impact.
- Steps to reproduce the issue (proof of concept if possible).
- Your contact information for follow-up questions.
Our commitment to you:
- We will acknowledge your report within 2 business days.
- We will provide a timeline for resolution and keep you informed of progress.
- We will not pursue legal action against researchers acting in good faith.
- We will credit you publicly (with your permission) once the issue is resolved.
Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it. We are working toward establishing a formal bug bounty program — stay tuned for updates.
Data Retention & Deletion
You stay in control of your data throughout its lifecycle.
Active Account
Your data is retained while your account is active. You can delete individual records in most apps as you go. Full data export is not available yet; it is being built, and until then we fulfil export requests manually at privacy@humanos.ai.
Account Deletion
Deleting your account deactivates it immediately and permanently: you are signed out everywhere and cannot sign back in. Your data is retained after deactivation, not erased. Permanent hard deletion is being built; to have your data erased now, email privacy@humanos.ai and we will do it manually.
Legal Retention
Certain data (e.g., billing records) may be retained as required by law. This data is minimal and stored separately from your account data.
For full details, see our Privacy Policy.
Security Inquiries
Have security questions or need to report a concern? We're here to help.