Trust and security

Suhep security whitepaper

Version 1.0, 3 November 2026. This paper describes how Suhep is built and run today. Items marked "rolling out November 2026" are not live yet; we update this page when they ship. We do not hold a SOC 2 report or an ISO 27001 certificate.

Trust overviewSub-processors

1. Architecture and hosting

  • Suhep is a web application (Next.js) with a self-hosted Appwrite backend (MariaDB database, file storage, sign-in).
  • EU hosting. Hetzner Online GmbH data centres in the EU: the application runs in Falkenstein, Germany; the database and file storage run in Helsinki, Finland. Customer ticket data is stored in the EU.
  • Servers run Hostao workloads in containers and accept administrator logins over SSH keys only (password logins are switched off).
  • Our own AI model, Suhep Decide (trained in-house), runs on our own EU server on an internal network with no public port.

2. Data we process

Ticket content, the contact details your customers give you (name, e-mail, phone, WhatsApp or Instagram handle), agent accounts, help-centre content and usage logs. We do not sell data and do not use your ticket data for advertising. The Suhep app has no ad trackers inside the product.

3. Encryption

  • In transit. TLS 1.2 or higher on every public endpoint, with HSTS.
  • Secrets. Customer AI keys (bring your own key) are encrypted with AES-256-GCM before they are stored and are never shown again in the browser.
  • Backups. Database backups are encrypted before they leave our servers.
  • Database encryption at rest. (rolling out November 2026) MariaDB data-at-rest encryption for tables, logs and temporary files.

4. Identity and access

  • Agents sign in with e-mail and password or with Google. Sign-up is protected by Cloudflare Turnstile against bots.
  • Two-factor authentication (TOTP) is available for every user.
  • Workspace roles: owner, admin and agent. The owner can remove a teammate's access at any time.
  • (rolling out November 2026) viewer and light-agent roles, a workspace-wide "require 2FA" setting, SAML 2.0 / OIDC single sign-on, SCIM 2.0 provisioning and an exportable workspace audit log.
  • Production access is limited to named Hostao administrators using SSH keys.

5. Application security

  • Security headers on every page: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
  • Workspace API routes check membership and role on the server. Outgoing webhooks are signed (HMAC) so receivers can verify them.
  • Rate limits and abuse checks on public chat, ticket and AI endpoints; bot checks on public forms.
  • Every release passes automated gates before it goes live: unit and end-to-end tests, type and lint checks and a privacy gate. Releases go out under a deploy lock, are watched for 15 minutes and roll back automatically if checks fail.
  • Source code is kept in private repositories.

6. AI safety

  • AI answers come from your published help articles and the current conversation.
  • Billing, account access, sensitive or uncertain requests go to a person and never get an automatic AI answer.
  • Bring your own key (Pro and Business): AI calls run under your own provider account and terms.
  • Suhep Decide classifies tickets in shadow mode first. We publish quality numbers only after real live data.

7. Availability, backups and recovery

  • Live status page at suhep.com/status plus outside uptime monitoring.
  • Daily encrypted database backups with 30-day retention; a restore was tested on 1 November 2026.
  • (rolling out November 2026) backups every 6 hours (recovery point objective 6 hours), a second encrypted backup copy on our own EU server and a timed restore drill every month.

8. Incident response

We triage security reports and incidents the same day. If personal data is affected, we tell affected customers without undue delay and within 72 hours of becoming aware, as set out in the DPA, and we publish service incidents on the status page.

9. Vulnerability management and testing

  • Dependency updates and regular checks of the public site (headers, TLS, exposed files).
  • Independent penetration test: not done yet. We will publish a summary letter when one is completed.
  • Responsible disclosure: vulnerability disclosure policy.

10. Privacy and compliance

  • Data Processing Agreement (GDPR Article 28): suhep.com/legal/dpa. India DPDP Act 2023: grievance officer.
  • Sub-processors by name: suhep.com/legal/subprocessors, with at least 30 days' notice before changes.
  • Workspace data is deleted on request or after the account closes, subject to backup expiry (30 days).
  • Certifications: no SOC 2 report or ISO 27001 certificate today. We answer security questionnaires in writing.

Contact

Security questions: support@suhep.com (subject "Security"). Data protection: dpo@suhep.com. Hostao L.L.C, 30 N Gould St, Ste 4000, Sheridan, Wyoming 82801, USA.