How we protect your members’ data, and where each control stands.
For the finance, security, legal and procurement teams who check a supplier before they sign. Every item shows whether it is in place today or still in progress, with a date, and every law links to its official text. We update these pages as each milestone is met.
Reviewed 18 October 2026
- Our role
- Processor. You stay in control of your members’ data
- Controls
- 9 of 31 in place today; every one by January 2027
- ISO/IEC 27001
- In progress. Certificate targeted for June 2027
- Penetration test
- Independent test booked for November 2026
- Incident notice
- Within 12 hours, with round-the-clock cover from November 2026
- Face and ID checks
- Not in use for any partner until 30 November 2026
- Hosting
- United States or EU, chosen per partner
- Company
- High Intent Media Inc., Delaware, USA
What already operates, and what you can rely on.
9 of our 31 security controls operate today. The rest finish by January 2027, each with its own date on the Security page.
- Named security and privacy owner
- Multi-factor sign-in on every staff, admin and cloud account
- TLS 1.2 or higher for all external traffic
- Encryption at rest (AES-256) for databases, storage and backups
- Secrets in a managed store, never in code, with key rotation
- Fraud and abuse monitoring of member behaviour
- Every staff view of partner member data logged
- Public route for reporting vulnerabilities (security.txt)
- Daily encrypted backups, held separately, kept 35 days
- Automated moderation supervised by our own trust and safety team
- Every reported profile reviewed by a person within 4 hours
In our standard agreement and data processing agreement.
None of these waits for a certificate.
- We act only on your written instructions, as your processor, under our standard DPA.
- You hear about a personal data breach within 12 hours, of us becoming aware of it.
- You can audit us, once a year, or after an incident.
- You can export all your data at any time, at no charge, in standard formats.
- Your data is returned or deleted within 30 days of the contract ending, with written confirmation.
- At least 30 days’ notice, before we add or replace a sub-processor.
- Member data is never sold or shared, and never used to train AI models.
Find what your team needs, page by page.
Company and continuity
Who we are, who signs, and what protects you if anything goes wrong
OpenSecurity controls
Every control with its status, mapped to ISO/IEC 27001 and BSI C5
OpenPrivacy and data transfers
Our role as processor, sensitive data, retention and transfers
OpenSub-processors
Who else handles member data, where, and under which safeguard
OpenAge checks and biometric data
How age and ID checks will work, and why none run until 30 November
OpenModeration and online safety
Reports, decisions, appeals and the DSA and Online Safety Act duties
OpenAI register
Every AI system on the platform, its status and how the AI Act treats it
OpenIncidents
Our notice times, set against your own legal deadlines
OpenLaws register
Every law we build for, with its official text and who carries each duty
OpenWhat happens next, and when.
| When | Milestone |
|---|---|
| October 2026 | Data protection officer appointed; 24-hour partner phone line issued |
| November 2026 | First independent penetration test of the platform; 24-hour on-call cover |
| 30 November 2026 | Written consent screen live; face and ID checks can start for partners who want them |
| December 2026 | Critical and high test findings fixed and retested; ISO/IEC 27001 auditor booked |
| January 2027 | Every control on these pages operating |
| June 2027 | ISO/IEC 27001 certificate (target) |
Every change, dated.
- Trust Center split into an overview and nine pages, with a laws register that links each law to its official text.
- Face and ID checks confirmed as not in use for any partner until 30 November 2026, when the written consent screen goes live.
- Sub-processor register now shows each provider’s legal entity, the data it handles and the transfer safeguard.
- Our suppliers’ SOC 2 reports moved from our own assurance to the sub-processor register.
- Security
- security@highintentmedia.com
- Privacy and DPA
- privacy@highintentmedia.com
- Data protection officer
- Being appointed, by 31 October 2026
- Partner phone line
- 24 hours a day, issued by 31 October 2026
The security pack, on request.
Choose what your team needs. We send documents to work email addresses, with a mutual NDA first if you prefer.
Found a security issue? Tell us.
Email security@highintentmedia.com with what you found and how to reproduce it. We reply within one working day and never take action against good-faith research.
Please don’t access other people’s data, disrupt the service or publish details until we have fixed the issue. Our contact details are also published in security.txt. More on how we work in Trust and safety and our privacy policy.