Home/Security

// SECURITY

Security Posture

Hypen is designed from first principles to be secure. Our architecture assumes compromise at every layer and provides cryptographic guarantees that do not depend on trust.

Architecture

Security Architecture

Every component of the Hypen stack is designed for defense in depth. We operate on the assumption that any individual layer may be compromised, and cryptographic controls at adjacent layers prevent lateral movement.

  • All traffic encrypted in transit using TLS 1.3 minimum
  • Mutual TLS (mTLS) enforced on all agent-to-proxy connections
  • Request payloads signed with HMAC-SHA256 before forwarding
  • Credential injection via ephemeral, scoped tokens (never static keys)
  • Zero persistent credentials stored in agent runtime memory
  • All vault operations require HSM-backed signing
Compliance

Compliance & Certifications

Hypen is designed to meet the requirements of regulated financial environments. The following certifications and frameworks are in progress or planned:

  • SOC 2 Type II — audit in progress (target: Q3 2026)
  • ISO 27001 — gap assessment complete
  • GDPR — data processing agreements available on request
  • PCI DSS Level 1 — scoping underway
  • DORA (EU Digital Operational Resilience Act) — readiness review in progress
Compliance reports and DPA templates are available to enterprise customers upon request. Contact security@hypen.network.
Vulnerability Disclosure

Responsible Disclosure Policy

We operate a responsible disclosure program. If you discover a security vulnerability in any Hypen system, we ask that you report it to us privately before public disclosure.

Please send vulnerability reports to security@hypen.network with:

  • A clear description of the vulnerability and affected component
  • Steps to reproduce the issue
  • Your assessment of potential impact
  • Any proof-of-concept code (if applicable)

We will acknowledge receipt within 24 hours, provide a remediation timeline within 5 business days, and notify you when the fix is deployed. We do not pursue legal action against researchers who follow this policy.

Penetration Testing

Penetration Testing

Hypen undergoes external penetration testing on a quarterly basis. Tests cover the proxy data plane, control plane API, vault infrastructure, and authentication systems. Summary reports are available to enterprise customers on request.

We also maintain a continuous bug bounty program. Details are available at security@hypen.network.