Security Policy

Last updated: January 13, 2026
Security practices for FinOps AI and every service operated by HostingX Solutions LLC. For vulnerability reports, email security@hostingx.co.il.
HostingX Solutions LLC · LLC No. 0008072296 · Founded 2026 · Registered in New Mexico, USA · 8206 Louisiana Blvd NE, Suite A #8186, Albuquerque, NM 87113, United States

1.Our Security Commitment

HostingX Solutions LLC is committed to protecting the confidentiality, integrity, and availability of our clients' data and systems. Security is embedded in every aspect of our service delivery.

2.Data Protection

Encryption

  • All data in transit protected with TLS 1.3
  • Data at rest encrypted with AES-256
  • Encrypted backups with secure key management
  • End-to-end encryption for sensitive communications

Access Controls

  • Least-privilege access model
  • Multi-factor authentication (MFA) required for all accounts
  • Role-based access control (RBAC)
  • Regular access reviews and revocation
  • Segregation of duties for critical operations

3.Infrastructure Security

Cloud Security

  • Infrastructure hosted in SOC 2 certified data centers
  • Network segmentation and isolation
  • Web Application Firewall (WAF)
  • DDoS protection and mitigation
  • Regular security hardening

Container & Kubernetes Security

  • Pod security policies and admission controls
  • Container image scanning (Trivy, Grype)
  • Runtime security monitoring
  • Network policies and service mesh
  • Secrets management (HashiCorp Vault, AWS SSM)

4.Application Security

Development Practices

  • Secure Software Development Lifecycle (SSDLC)
  • Code review requirements
  • Static Application Security Testing (SAST)
  • Dynamic Application Security Testing (DAST)
  • Dependency scanning and vulnerability management

CI/CD Security

  • Pipeline security scanning
  • Signed container images (Cosign / Sigstore)
  • Immutable infrastructure
  • Automated compliance checks
  • GitOps with audit trails

5.Vulnerability Management

  • Continuous vulnerability scanning
  • Risk-based prioritization
  • 24-hour patching for critical vulnerabilities
  • 7-day patching for high-severity issues
  • Monthly security updates
  • Coordinated disclosure program

6.Monitoring & Incident Response

24/7 Security Operations

  • Real-time security monitoring (SIEM)
  • Intrusion detection / prevention systems (IDS/IPS)
  • Log aggregation and analysis
  • Anomaly detection and alerting
  • Automated threat response

Incident Response

  • Documented incident response plan
  • 1-hour notification for security incidents
  • Forensic investigation capabilities
  • Post-incident reviews and improvements
  • Communication protocols with affected parties

7.Compliance & Auditing

Standards & Frameworks

  • Aligned with SOC 2 Type II requirements
  • CIS Benchmarks for infrastructure hardening
  • OWASP Top 10 mitigation
  • NIST Cybersecurity Framework
  • ISO 27001 control implementation (planned)

Audit & Logging

  • Comprehensive audit logging
  • Tamper-proof log storage
  • 90-day log retention (longer for compliance)
  • Regular security audits
  • Third-party penetration testing (annual)

8.Employee Security

  • Background checks for all employees
  • Security awareness training
  • Signed confidentiality agreements
  • Clean desk and screen policies
  • Secure remote work practices

9.Vendor Security

  • Security assessment for all vendors
  • Data Processing Agreements (DPAs)
  • Regular vendor reviews
  • Subprocessor documentation
  • Supply chain risk management

10.Business Continuity

  • Disaster recovery plan with 4-hour RTO
  • Automated backups (hourly snapshots, daily full)
  • Multi-region redundancy
  • Failover procedures tested quarterly
  • Data retention policies

11.Client Responsibilities

Clients should:

  • Use strong, unique passwords
  • Enable MFA on all accounts
  • Protect API keys and credentials
  • Report security concerns promptly
  • Follow security best practices
  • Conduct their own security assessments

12.Security Reporting

Report security issues:

  • Email: security@hostingx.co.il
  • PGP key available upon request
  • Coordinated disclosure: 90-day window
  • Recognition for responsible disclosure
We do not support bug bounties but appreciate responsible disclosure.

13.Contact

Security questions
security@hostingx.co.il
General inquiries
legal@hostingx.co.il
FinOps AI inbox
hello@getfinops.cloud