Security & trust

We teach security for a living, so we hold ourselves to the practices we teach. This page explains how we protect your account and your team's training data — written plainly, and kept honest about what we do and don't yet have.

Account & password security

• Passwords are hashed, never stored. We hash with PBKDF2-SHA256 (100,000 iterations and a unique random salt per account) using the browser/runtime WebCrypto API. Your plaintext password is never written to disk.
• Server-side sessions. Sign-in uses server-side sessions stored in our database, carried in an HttpOnly, SameSite=Lax, Secure cookie that expires after 30 days — not a token sitting in local storage.
• Abuse protection. Login, sign-up and team-invite endpoints are rate-limited to blunt brute-force and relay abuse.
• Email verification is supported for accounts when enabled on the deployment.

Data & privacy

• Privacy-first, PII-free analytics. Our product analytics store anonymous event counts only — no IP addresses, no names, and no third-party trackers or ad networks. We're not in the business of selling data.
• What we store. Your email and chosen handle, your hashed password, and your training-completion records (which games you cleared and when). For teams, an owner can see members' completion counts and dates — that's the point of the audit evidence — but not their passwords.
• In transit. Everything is served over HTTPS with Cloudflare's TLS; the apex and www are redirected to a single canonical HTTPS host.

Payments

All payments are processed by Stripe, a PCI-DSS Level 1 service provider. We never see or store your card number — our systems only hold a Stripe customer/subscription reference so we can manage your plan. You can manage or cancel your subscription anytime from the Stripe billing portal.

Infrastructure & subprocessors

HACKIN'GAMES runs on Cloudflare's edge platform. We use a small, deliberate set of subprocessors:

Subprocessor	Purpose	Data it touches
Cloudflare	Hosting, database (D1), key-value store, CDN/TLS	All application data, encrypted in transit
Stripe	Subscription billing & payment processing	Billing details; card data handled by Stripe, never by us
Cloudflare Email	Transactional email (verification, team invites), when enabled	Recipient email address

Your data, your control

Want a copy of your data, or want your account and training records deleted? Email support@hackingames.com and we'll take care of it.

Honest scope

We describe the controls we actually operate today. HACKIN'GAMES does not yet hold a third-party security certification (such as a SOC 2 attestation) for our own platform — and we won't claim one until it's real. What we offer is the training and the per-employee completion evidence your auditor needs for your security-awareness-training control; your auditor makes the final determination. See how that maps to SOC 2, ISO 27001 and HIPAA.