Security

Encryption

All traffic to and from Hypado is encrypted in transit using HTTPS/TLS. Sensitive data at rest, including the access tokens for accounts you connect, is encrypted on our servers.

Read-only access to connected accounts

When you connect Google Search Console or Google Analytics, Hypado requests read-only scopes only. We can read the data needed to power your dashboards and reports, but we cannot modify or delete anything in your Google account. You can revoke Hypado's access at any time from your Google Account permissions page or by disconnecting the integration in Hypado.

Access controls

Access to production systems and customer data is restricted to the people who need it to operate and support the service, and is protected by strong authentication. We follow the principle of least privilege and log administrative access.

Data handling and retention

We retain your data only while your account is active. If you disconnect a Google integration, we delete the associated Google user data within 30 days; if you close your account, we delete your account data within 30 days, except records we must keep to meet legal obligations. Full detail is in our Privacy Policy.

Payments

Card payments are handled by our payment processor. Hypado does not store full card numbers on its own servers.

No selling, no model training

We do not sell your data and we do not use the data you connect, including Google user data, to train AI models. When you use AI features, your data is sent only to the AI provider you chose to connect, so it can generate the response you asked for.

Reporting a vulnerability

If you believe you've found a security issue, we want to hear about it. Email [email protected] with the details and we'll respond promptly. Please give us a reasonable chance to investigate and fix the issue before disclosing it publicly.