Where we stand on compliance, how we protect your data, and what we do when a security issue hits the news. Written plainly, with nothing claimed that we can't show.
When a vulnerability affects software the internet runs on, we check every Hiveku system and post what we found here.
No action needed for sites hosted on Hiveku
PHP2Shell vulnerabilities statement
CVE-2026-109618 and CVE-2026-109619
On October 21, 2026, the PHP project released fixes for two critical flaws in PHP itself, known as PHP2Shell. On a web server that runs PHP, they can let an attacker run their own code without signing in, and attacks have been reported.
Websites and apps hosted on Hiveku are not affected. They are built with modern web frameworks or plain HTML and run on hosting that does not run PHP. The Hiveku app, its API, its AI agents, and the analytics, forms and chat code we add to your site don't use PHP either. You don't need to do anything.
We also checked our internal systems. One internal tool, the admin console of our phone system, is built with PHP. It can't be reached from the public internet: only Hiveku staff can open it, over a private network, and we confirmed that the public internet is refused on every address it has. We are updating it to PHP's fixed release.
If your website is hosted somewhere else, for example a WordPress site you connect to Hiveku, its server is run by your hosting company. Ask them to confirm their PHP is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or on their operating system's fixed package. PHP 7 and older get no fix and need an upgrade.
We are a growing company. Here is exactly what we have and what we don't, so you can decide what fits your business.
SOC 2
Not audited
We do not have a SOC 2 report, and no auditor has reviewed our controls. The practices further down this page are what we run today.
ISO 27001
Not certified
We are not ISO 27001 certified.
HIPAA
Not supported
Hiveku does not support HIPAA workloads today. Please don't store protected health information, such as patient records, in Hiveku.
Card payments (PCI DSS)
Handled by our payment processors
Card numbers go straight from the browser to our PCI DSS certified payment processors. Hiveku never stores them: we keep only the card brand, the last four digits and the expiry date.
Your data
Yours to export
Owners and admins can export everything the account holds, any time, without asking us, and owners can delete the account from Settings. See our Privacy Policy for how we handle personal data.
Security practices
How We Protect Your Data
The controls we run today. Each one is live in the product or in how we operate it.
Access Control
Sign in with a password, Google, Apple or a passkey
Optional two-factor sign-in with an authenticator app, a text code or backup codes
Passwords are checked against known breaches, and repeated failed sign-ins lock the account for an hour
Custom roles decide what each person can see and change, and a role applies the same in the app, through API keys and through AI agents
Data Protection
Each Hiveku service reaches the database with its own limited role, and row-level security is on for every table
Data is encrypted at rest by our cloud providers; backups, call recordings, your own AI key and payment credentials get additional encryption
The production database is backed up every night to separate encrypted storage and kept for a year
Site secrets stay hidden, set per environment, and an AI tool that asks to see one waits for a person
Hosting
The app, databases, file storage and hosted websites run in US data centers of major cloud providers
Every connection to Hiveku and to the sites we host uses HTTPS with TLS 1.2 or newer
Separate development, staging and production environments
Snapshots before and after every deploy, and restore points you can preview or restore
Audit and Logging
Owners and admins can see a log of what each person on the team did
Every call through an AI connector key is logged with the tool, its arguments and the caller's IP address
Sign-ins and account changes are logged and kept for 1 year
Error reports to our monitoring service leave out cookies, sign-in headers and IP addresses
AI and Approvals
Hiveku does not train AI models on your data
AI agents ask a person before acting on anything important
Phones carry a daily cap on outbound call spend
Monitoring and Development
Errors, infrastructure and threat alerts are monitored automatically and reach our team
Uptime of the Hiveku app is published at status.hiveku.com
Code changes to our main services are scanned for leaked secrets, and dependencies are checked weekly for known vulnerabilities
When a vulnerability hits the news, we check every Hiveku system and post what we found on this page
See every control, with screenshots, and what we log and for how long, on our Security page.
Ask Us for More
Reviewing Hiveku for your business? We'll send you any of these:
Answers to your security questionnaire
How your data is backed up, and how long backups are kept
Details of your own account's access and activity logs
