Security

API keys

• A key is shown once, when you create it. We never store the key itself, only a bcrypt hash of it and an HMAC-SHA256 of it under a server-side secret, which lets us find the key quickly without a reversible copy.
• Search keys (hb_src_) can only search. Admin keys (hb_adm_) write documents and change settings. A key can be limited to chosen indexes or engines, and can expire.
• A key you delete stops working on the API within 5 seconds.
• Keys for signing in the Headband CLI are minted only after a signed-in person approves the request in the dashboard. CLI sign-in codes are stored as hashes and expire after 15 minutes.

Encryption

At rest

• The address and credentials of an engine you bring are encrypted with AES-256-GCM before they reach the database. Production refuses to start without the encryption key.
• The disks of the servers that run hosted engines are encrypted with LUKS2, unlocked at boot by the server's TPM.
• Hosted engines that keep their data in bucket storage store it as compressed chunks, each sealed with AES-256-GCM before upload, under keys held per organization.
• Engine backups are encrypted on the server before they leave it. The nightly copy of the control-plane database is encrypted before upload, and the job that writes it holds only the public key.

In transit

• headband.dev, the API and the dashboard are served only over HTTPS (TLS 1.2 or later), with HSTS. Plain HTTP redirects to HTTPS.
• Each engine server has its own Let's Encrypt certificate. Calls from the control plane to a server go over HTTPS and are signed, so a server acts only on requests from us.

Where your data is

Everything runs in the United States. There is no EU region today.

• Hosted engines run in one region, ewr1 in New York, on two dedicated servers we operate: ewr1-a, rented from ReliableSite, and ewr1-b, rented from Hostkey.
• The control-plane database (accounts, organizations, projects, key hashes, usage and search analytics) runs on BataData in its US East region.
• Bucket storage for hosted engines, and the nightly database copies, are in Backblaze B2's US East region.
• The website, dashboard and API run on Vercel.
• Engines you bring stay wherever you run them. Your documents go to that engine, not to our servers.

Each hosted engine has one home server. If that server goes down, engines on bucket storage move to the other server by themselves, in about 2 to 3 minutes. Always-on Meilisearch and Elasticsearch engines on bucket storage and a paid plan also normally keep a live read-only copy on the other server, so their searches move to it within seconds. Other engines are down until the server comes back or we move them by hand. The SLA page says more.

Backups

• Control-plane database: BataData keeps point-in-time restore for 7 days. We also take a nightly encrypted pg_dump to Backblaze B2, kept for 30 days under object lock, so it cannot be deleted early. Both were restored in a drill on October 27, 2026, and we repeat the drills monthly.
• Hosted engines on bucket storage: the bucket is the engine's home, and the server's disk is a cache. Servers can write and hide data in the bucket but cannot erase it for good, and hidden versions stay recoverable for 30 days.
• Other hosted engines: encrypted backups to Cloudflare R2, a rolling set covering up to the last 14 days.
• Engines you bring: backing them up is up to you or whoever runs them.

Access control

Your team

• You sign in with GitHub or Google. We never see your password, and we keep no provider tokens. The session lasts up to 30 days.
• An organization has owners, admins and members. Inviting people, changing roles and billing are limited by role.
• A dashboard session or an API key acts only inside its own organization.

Our side

• Headband is run by a small team at ZVN DEV LLC. Our staff console is open only to a short list of named staff accounts, and is invisible to everyone else.
• The engine servers accept SSH by key only, from an allowlist of addresses, behind a default-deny firewall. Server credentials can never permanently erase bucket data.
• We do not look at your documents or searches unless you ask us to, for support, or we must to keep the service secure.

Monitoring

• A watchdog runs every minute. It marks a server down after 60 seconds without a heartbeat and alerts us by email.
• Each server's gateway is probed from outside twice a minute. A server whose gateway stops answering is marked within about 90 seconds, and requests for its engines get a fast 503 instead of hanging.
• The status page shows the same checks, refreshed about once a minute.

What we do not have yet

• No SOC 2 or ISO 27001 report. We have not been audited.
• No single sign-on (SAML or OIDC) beyond GitHub and Google sign-in.
• No EU or other region outside the United States.
• No audit log of your organization's actions that you can view.
• No automatic failover for engines that are not on bucket storage.

If one of these blocks you, tell us at support@headband.dev. It helps us decide what to build next.

Analytics and session recordings

We record some visits to improve the product. The dashboard hides your documents, search queries and results, project names, API keys and engine credentials in those recordings, and the Documents and Search pages are never recorded. The privacy policy has the details, and the DPA page lists every provider that processes data for us.

Report a vulnerability

Email support@headband.dev with “Security” in the subject. Tell us what you found, how to reproduce it, and what it could affect. Our contact details are also in /.well-known/security.txt.

• Test only against your own account and data.
• Do not read, change or delete other people's data, and stop if you reach any.
• Do not run denial-of-service tests or send spam.
• Give us a chance to fix the issue before you publish it.

We read every report, reply to tell you what we will do, and tell you when it is fixed. We do not run a paid bug bounty.