How we protect your data

• Encrypted connections

  All connections to hangel.org are encrypted with HTTPS. We send the HSTS header, which tells browsers to open the site only over a secure connection.

• Google Cloud infrastructure in Europe

  Our database runs in the eur3 location in Europe (Belgium and the Netherlands), our application server in the Netherlands and our scheduled jobs in Belgium. Google Cloud encrypts stored data by default.

• Access rules

  Access to the database and file storage is limited by security rules enforced on the server; a record can only be reached by someone authorised to see it. We have automated tests for these rules.

• Sign-in

  Sign-in is handled by Google’s Firebase Authentication; passwords are not stored in our database. You can also sign in with a passkey.

• Browser security headers

  Our pages are served with security headers that stop other sites from secretly embedding hangel, block content-type confusion attacks and limit unneeded camera, microphone and location access. The core rules of our Content Security Policy (CSP) are enforced.

• Bot protection

  We use Google reCAPTCHA and additional checks to filter automated submissions on sign-up, contact and survey forms.

• Error monitoring and analytics

  We monitor errors with Sentry in its European (Germany) data region; names, email addresses and user IDs are not added to error reports. Visit analytics only runs if you have given cookie consent, and form fields are masked.

So that we do not mislead you, here is what we do not have yet:

• We do not hold an ISO/IEC 27001 certificate, a SOC 2 report or any independent audit report. We are building our information security management system based on ISO/IEC 27001.
• We have not commissioned a penetration test from an independent firm; our security reviews so far have been carried out by our own team.
• The full version of our Content Security Policy, which restricts script sources, is not enforced yet; it currently runs in report-only mode.
• We do not pay rewards for vulnerability reports.

If you think you have found a security vulnerability in hangel, please write to us. We review every report made in good faith.

Send your report to info@hangel.org with the subject “Security report”. Including the following helps us move faster:

• The address or app screen where the issue is
• Step-by-step instructions to reproduce it
• Its possible impact: which data or function can be reached
• A screenshot or short video, if you have one

Our commitment

• We confirm receipt of your report within 3 business days.
• We share our assessment and the steps we will take with you.
• We let you know when the issue is fixed.
• If you wish, we thank you by name; otherwise your name stays private.

While researching

• Use only your own account or test accounts you created.
• Do not access, change or delete other people’s data. If you reach it by accident, stop, do not keep the data and tell us.
• Do not run tests that slow down or stop the service.
• Do not attempt phishing, social engineering or physical access.
• Do not share details with others until the issue is fixed; if you want to publish, let us agree on the timing together.

We will not file complaints against people who follow these rules, research in good faith and report what they find to us.

With every release we automatically generate a list of the open-source components our web application uses and publish it in CycloneDX format. Organisations can use it in their own supply-chain assessments.

Open the SBOM file (JSON)

For requests about your personal data, write to kvkk@hangel.org. Organisations can send security and data protection questions to info@hangel.org.

• How we process data: Privacy Policy
• Machine-readable contact file: security.txt