See your app rebuilt
Trust Center / Security controls

Every security control, with its status and date.

Our technical and organisational measures (TOMs), as they stand today. 9 of 31 operate now; the rest finish by January 2027. Each area shows the ISO/IEC 27001:2022 Annex A controls and BSI C5 domains it answers.

Reviewed 18 October 2026

Independent assurance

Checked by people who don’t work for us.

We are building our security programme to ISO/IEC 27001 and will be audited against it. Until the certificate is issued, we share the same evidence an auditor would see, under NDA.

ISO/IEC 27001:2022

Security management system covering the platform, our people and our suppliers. Auditor booked by 15 December 2026; certification audits in the second quarter of 2027.

In progress · target June 2027

Penetration testing

An outside firm tests the platform, then every year and after major changes. Critical and high findings are fixed and retested, and partners get the summary.

Planned · booked for Nov 2026

Our hosting providers’ own SOC 2 reports are listed on the Sub-processors page. They cover their services, not ours.

Security controls

What protects the platform, and when.

In place
Operating today.
To confirm
We believe it is in place and are collecting the evidence.
In progress
Work has started and finishes by the date shown.
Planned
Work starts soon and finishes by the date shown.

Governance

ISO/IEC 27001 Annex A A.5.1, A.5.2, A.5.4 · BSI C5 OIS, SP

  • Information security management system built to ISO/IEC 27001:2022In progress · Jan 2027
  • Named security and privacy ownerIn place
  • Data protection officer appointedIn progress · Oct 2026
  • Risk register, reviewed by management every quarterIn progress · Oct 2026
  • Security policy set approved by managementIn progress · Oct to Dec 2026

Access

ISO/IEC 27001 Annex A A.5.15, A.5.18, A.6.5, A.8.2, A.8.5 · BSI C5 IDM

  • Multi-factor sign-in on every staff, admin and cloud accountIn place
  • Least privilege by role, no shared accountsIn progress · Oct 2026
  • Leavers removed from every system on their last dayIn progress · Oct 2026
  • Access to partner production data limited to named staff and reviewed every quarterPlanned · Jan 2027

Encryption

ISO/IEC 27001 Annex A A.8.24 · BSI C5 CRY

  • TLS 1.2 or higher for all external trafficIn place
  • Encryption at rest (AES-256) for databases, storage and backupsIn place
  • Member passwords stored only as salted bcrypt hashesTo confirm · Oct 2026
  • Secrets in a managed store, never in code, with key rotationIn place

Data separation

ISO/IEC 27001 Annex A A.8.20, A.8.31, A.8.33 · BSI C5 OPS, COS

  • A separate database for each partnerTo confirm · Oct 2026
  • Development, staging and production kept apart; no member data in testingIn progress · Nov 2026
  • No public database endpoints; admin only through signed-in, logged routesIn progress · Nov 2026

Monitoring

ISO/IEC 27001 Annex A A.8.15, A.8.16 · BSI C5 OPS, SIM

  • Fraud and abuse monitoring of member behaviourIn place
  • Every staff view of partner member data loggedIn place
  • Central logs of sign-ins, admin actions and data access, kept at least 12 monthsIn progress · Nov 2026
  • Security alerts with on-call response 24 hours a dayIn progress · Nov 2026

Building and fixing

ISO/IEC 27001 Annex A A.8.4, A.8.8, A.8.25, A.8.28, A.8.32 · BSI C5 DEV, OPS

  • Peer code review and a protected main branchIn progress · Nov 2026
  • Dependency and secret scanning on every buildIn progress · Nov 2026
  • Fixes within 7 days (critical), 30 days (high), 90 days (medium)In progress · Nov 2026
  • Public route for reporting vulnerabilities (security.txt)In place

Resilience

ISO/IEC 27001 Annex A A.5.29, A.5.30, A.8.13 · BSI C5 BCM, OPS

  • Daily encrypted backups, held separately, kept 35 daysIn place
  • Backup restore tested every quarterPlanned · Nov 2026
  • Continuity and recovery plan, exercised every yearPlanned · Dec 2026

People and suppliers

ISO/IEC 27001 Annex A A.5.19 to A.5.22, A.6.3, A.6.6 · BSI C5 HR, SSO

  • Confidentiality terms for every employee and contractorTo confirm · Oct 2026
  • Security and privacy training when people join and every yearPlanned · Nov 2026
  • Security review of every sub-processor before use and every yearIn progress · Nov 2026
  • Written terms stopping AI providers training on partner dataIn progress · Nov 2026

Every control above will be operating by 1 January 2027, except the ISO/IEC 27001 internal audit (March 2027), the certificate (June 2027) and full accessibility beyond sign-up and purchase (June 2027). The references are a map of which standard each area answers, not a claim of certification. Recovery targets: we aim to lose no more than 24 hours of data and to be back up within 24 hours.

For NIS2 supply chain reviews

The supplier measures NIS2 expects.

If your company is an essential or important entity under NIS2 (in Germany, under the new BSI Act), you must manage the security of your suppliers. Social networking platforms are listed in Annex II of the Directive.

  • The Article 21 measures are the controls above: risk management, access, encryption, logging, vulnerability handling, backups and continuity, staff and supplier security.
  • Notice fast enough for your deadlines. First notice within 12 hours, against your 24-hour early warning. See Incidents.
  • Your checks. We complete your own security questionnaire, and you can audit us once a year or after an incident.
Laws and standards on this page

What these controls answer.

NIS2 Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690

In progress · Jan 2027

Official text: EUR-Lex

What matters
Social networking platforms are listed in Annex II. Regulated partners must manage supplier security (Article 21(2)(d)) and report incidents in 24 hours, 72 hours and one month (Article 23).
Our part
Meet the Article 21 measures as your supplier, and give you notice fast enough for your Article 23 deadlines.

NIS2 Implementation Act and the new BSI Act (NIS2UmsuCG, BSIG)

In progress · Jan 2027

Official text: bsi.bund.de

What matters
In force since 6 December 2025. German companies in scope must register with the BSI and pass security duties down to their suppliers by contract.
Our part
Meet the NIS2 measures, and support your supplier checks with our questionnaire answers and audit rights.

ISO/IEC 27001:2022

In progress · target June 2027

Official text: iso.org

What matters
Information security management system, audited by an accredited body.
Our part
Build the system, book the auditor by 15 December 2026, certificate targeted for June 2027.

BSI C5 cloud computing criteria catalogue

Partly in place

Official text: bsi.bund.de

What matters
The cloud security criteria German buyers often ask about.
Our part
Our controls are mapped to the C5 domains on the Security page. No C5 attestation yet.
More in the Trust Center

Company and continuity

Who we are, who signs, and what protects you if anything goes wrong

Open

Privacy and data transfers

Our role as processor, sensitive data, retention and transfers

Open

Sub-processors

Who else handles member data, where, and under which safeguard

Open

Age checks and biometric data

How age and ID checks will work, and why none run until 30 November

Open

Moderation and online safety

Reports, decisions, appeals and the DSA and Online Safety Act duties

Open

AI register

Every AI system on the platform, its status and how the AI Act treats it

Open

Incidents

Our notice times, set against your own legal deadlines

Open

Laws register

Every law we build for, with its official text and who carries each duty

Open

Questions for our security or privacy team? security@highintentmedia.com and privacy@highintentmedia.com. Or request the security pack.

Savings and value estimate

What your platform costs you, in profit and value.

Loading the estimate…