Security at haih

1. Infrastructure & encryption

• TLS 1.3 for all client-server communication
• AES-256 encryption at rest for all database records
• Row-level security enforced on every table
• Database backups encrypted and retained for 30 days

2. Identity verification

Every buyer and seller goes through identity verification before they can reach anyone.

For sellers

• Work email verification required (no personal email providers accepted)
• Company domain matched against known business registries
• Profile review before activation: name, title and company validated
• Verified seller badge shown on every lobby request
• Reputation score visible to buyers before they accept

For buyers

• Work email verification with three-layer validation (free provider block, generic prefix block, ambiguous prefix warning)
• Company association verified through email domain
• Lobby limits prevent inbox flooding: up to 10 sellers at a time
• Buyers control who enters; no seller can bypass the lobby

3. How the lobby protects you

On open platforms, anyone can message anyone. haih puts a permission step between every interaction.

• Sellers cannot email, call or message buyers without lobby approval
• Buyers set their own lobby limit, up to 10
• Auto-decline rules filter out unqualified sellers
• Every lobby request is logged with timestamp, identity and source
• Declined sellers cannot send another request without a buyer invitation

4. Data access

Row-level security means users can only access their own data. It’s enforced in the database itself, so even a bug in application code can’t return someone else’s records.

• Sellers see only their own contacts, conversations and lobby requests
• Buyers see only their own lobby, needs and messages
• All API endpoints verify authentication before processing requests

5. Communication

• All messages stored encrypted with row-level security
• SMS sent from carrier-verified numbers
• Email notifications authenticated with DKIM, SPF and DMARC
• No message content is shared with third parties or used for advertising
• Conversation history is retained only as long as the connection is active

6. AI

haih uses AI for features like live Q&A on seller profiles .

• AI models process data in-session only, with no training on your content
• Knowledge base documents are scoped to each seller and never shared across accounts
• Buyer questions are visible to that seller, not to other buyers

7. Bounce & fraud prevention

• Bounced emails remove the contact automatically, with no retries to bad addresses
• Rate limits on connection requests, messages and lobby requests
• Email validation blocks free providers, generic inboxes and known spam addresses
• Sellers who break the acceptable use policy are suspended

8. Portability & deletion

Your data belongs to you, not haih and not your employer.

• Full export of profile, connections, lobby requests, messages and ratings (JSON and CSV)
• Deactivation is reversible: your profile disappears but data is kept
• Deletion is permanent after 30 days, and all personal data is destroyed
• Change companies and your seller reputation follows you

9. Compliance

• SOC 2 Type II: audit in progress
• GDPR: data processing addendum available for EU entities
• CCPA: California consumer rights honored on request
• TCPA: all SMS requires prior express consent with logged opt-in
• CAN-SPAM: all emails include unsubscribe and a physical address

10. Incident response

We investigate every incident and notify affected users within 72 hours of a confirmed breach.

• Post-incident review shared with affected parties, with root cause and fix
• All incidents logged and retained for compliance audit

Report a vulnerability

Found a security issue? Email security@haih.ai. We respond within 24 hours.

For general support, email support@haih.ai.