Hampala operates inside our clients' contracts, suppliers, and payment systems. We treat security as a precondition for that work — not a checkbox. This page summarizes our current controls; a detailed security overview is available to clients and prospects under NDA.
All Hampala personnel use individually provisioned accounts with mandatory multi-factor authentication. Access to client systems is granted on a least-privilege basis, time-bound to the engagement, and revoked promptly on offboarding or role change.
Data is encrypted in transit (TLS 1.2+) and at rest on managed infrastructure. Sensitive client documents are stored in access-controlled workspaces, segregated per client. We do not co-mingle client data and do not use client operational data to train models or for any secondary purpose.
Our website and internal tools run on reputable cloud providers with SOC 2 and ISO 27001 attestations. We rely on hardened defaults, automated patching, and continuous monitoring rather than bespoke infrastructure.
Operators are vetted before engagement and bound by written confidentiality obligations that survive the end of their relationship with Hampala. Security awareness is part of onboarding and refreshed annually.
We maintain a curated list of subprocessors and vendors. Each is reviewed for security posture, data handling practices, and jurisdictional fit before being introduced into a client workflow.
We maintain a documented incident response process. In the event of a security incident affecting client data, we will notify affected clients promptly in line with contractual and regulatory obligations, and coordinate containment and remediation.
If you believe you have found a security issue affecting Hampala, please email hello@hampala.com with details. We appreciate responsible disclosure and will acknowledge receipt within two business days.