Request Early Access

Updated on June 13, 2025

Updated on June 13, 2025

Privacy policy

At Heist, your privacy is important to us. This Privacy Policy explains how we collect, use, and protect your personal information when you use our penetration testing platform and security services.

At Heist, your privacy is important to us. This Privacy Policy explains how we collect, use, and protect your personal information when you use our penetration testing platform and security services.

Information we collect

We collect the following information when you use Heist:

  • Basic account details like name and email address for authentication

  • Workspace information to organize your penetration testing projects

  • Company metadata necessary to deliver pentests and operate the platform

  • Pen test data including subdomains, routes, cookies, tokens, and network events generated during security assessments

  • Usage information to improve our platform and services

We collect the following information when you use Heist:

  • Basic account details like name and email address for authentication

  • Workspace information to organize your penetration testing projects

  • Company metadata necessary to deliver pentests and operate the platform

  • Pen test data including subdomains, routes, cookies, tokens, and network events generated during security assessments

  • Usage information to improve our platform and services

How we use your information

We use your information to:

  • Deliver penetration testing services and operate our platform

  • Provide security insights and vulnerability assessments

  • Improve the accuracy and effectiveness of our security testing tools

  • Offer customer support and platform improvements

  • Send you relevant security updates and platform features

  • Maintain compliance with industry security standards (SOC 2 Type II and ISO 27001)

We use your information to:

  • Deliver penetration testing services and operate our platform

  • Provide security insights and vulnerability assessments

  • Improve the accuracy and effectiveness of our security testing tools

  • Offer customer support and platform improvements

  • Send you relevant security updates and platform features

  • Maintain compliance with industry security standards (SOC 2 Type II and ISO 27001)

How we share your information

We do not sell your data. We only share it with:

  • Trusted third-party services that help us operate our platform (e.g., cloud infrastructure providers with strict security policies)

  • Law enforcement if legally required

  • Security partners when necessary to deliver comprehensive penetration testing services

We do not sell your data. We only share it with:

  • Trusted third-party services that help us operate our platform (e.g., cloud infrastructure providers with strict security policies)

  • Law enforcement if legally required

  • Security partners when necessary to deliver comprehensive penetration testing services

Data security

We use industry-leading security practices to protect your information:

  • End-to-end encryption with TLS (v1.2+) for all data in transit

  • AES-256 encryption for all data at rest

  • Access control following the principle of least privilege managed through IAM

  • Secure infrastructure hosted on GCP and Supabase with world-class protections

  • Read-only access to your systems during pentests - we never access or move your money or sensitive business data

  • Automated scaling and redundancy to ensure high availability

  • Continuous monitoring with logs kept for audit and forensic use

  • Daily backups with 30-day retention

  • Physical security through our cloud providers' certified data centers

Your connected systems remain secure throughout our testing process. We use grey box testing and emulate attackers with controlled access to your platform, but never access your actual codebase.

We use industry-leading security practices to protect your information:

  • End-to-end encryption with TLS (v1.2+) for all data in transit

  • AES-256 encryption for all data at rest

  • Access control following the principle of least privilege managed through IAM

  • Secure infrastructure hosted on GCP and Supabase with world-class protections

  • Read-only access to your systems during pentests - we never access or move your money or sensitive business data

  • Automated scaling and redundancy to ensure high availability

  • Continuous monitoring with logs kept for audit and forensic use

  • Daily backups with 30-day retention

  • Physical security through our cloud providers' certified data centers

Your connected systems remain secure throughout our testing process. We use grey box testing and emulate attackers with controlled access to your platform, but never access your actual codebase.

Your rights

You may:

  • Request access to your data stored on our platform

  • Correct or delete your information

  • Withdraw your consent to data processing

  • Export your data from our platform

You may:

  • Request access to your data stored on our platform

  • Correct or delete your information

  • Withdraw your consent to data processing

  • Export your data from our platform

Changes to this policy

We may update this policy to reflect changes in our services or legal requirements.

We may update this policy to reflect changes in our services or legal requirements.

Contact us

If you have questions or concerns about this privacy policy or our data practices, please contact us at: legal[at]heisthq.com

If you have questions or concerns about this privacy policy or our data practices, please contact us at: legal[at]heisthq.com

Get ahead of your vulnerabilities. Run your pentests with Heist.

Request Early Access

Get ahead of your vulnerabilities. Run your pentests with Heist.

Request Early Access

Get ahead of your vulnerabilities. Run your pentests with Heist.

Request Early Access