Privacy Policy

Who we are

Hitt Security is a product operated by Extant 2000 LLC, the company behind the Hitt Hosting suite. This Privacy Policy explains what information we collect when you use Hitt Security, how we use it, where it is stored, and the rights you have over it. If you have questions, contact us at privacy@hitthosting.com.

Information we collect

We collect only what we need to provide and secure the service:

• Account & contact details — such as your name, email address, and organization, used to create and administer your account.
• Billing information — payments are processed by Stripe. We do not store full card numbers.
• Usage & log data — records of how the service is accessed and used, including technical logs.
• Content you provide — the data and content you put into the product.

How we use it

We use the information we collect to provide, maintain, and secure the service; to process payments; to communicate with you about your account; to monitor and improve reliability and performance; and to meet our legal obligations. We do not sell personal data.

Where your data is hosted

All data is stored and processed in the United States. Our application, web, and mail servers run in Warrenton, Virginia (OVH US). Our primary application database runs on managed PostgreSQL (Supabase) in a US region (AWS US West, Oregon). No data is stored or processed outside the United States.

How we secure it

We take a layered approach to protecting your data:

• Data is encrypted in transit using TLS.
• The application database is encrypted at rest.
• PostgreSQL row-level security enforces per-organization data isolation.
• We keep audit logging of access to and changes of sensitive data.
• A web application firewall (ModSecurity) and intrusion detection (CrowdSec) guard the service.
• We run regular vulnerability scanning.
• Administrative access is restricted.
• Payments are handled by Stripe (PCI-DSS Level 1); full card numbers are never stored.
• We keep regular backups and production error monitoring.

We do not currently hold SOC 2, ISO 27001, HIPAA, ITAR, FedRAMP, or PCI certification. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Service providers

We share data with a limited set of service providers (subprocessors) that help us operate the service. Our email is self-hosted and is not handled by a third party. We do not sell personal data.

Data retention

We keep your data for as long as your account is active and for as long as we are legally required to retain it. After that, we delete or anonymize it. You can request an export or deletion of your data at any time.

Your rights

You have the right to access, correct, delete, and export your personal data. To exercise any of these rights, contact us at privacy@hitthosting.com.

Your US state privacy rights

If you live in California, Virginia, Colorado, Connecticut, Texas, Oregon, or another US state with a consumer-privacy law, you have the right to know what personal data we hold about you, to request its correction or deletion, and to receive a copy. We do not sell your personal data, and we do not share it for cross-context behavioral advertising. Exercising these rights will not result in worse treatment. To make a request, email privacy@hitthosting.com — we may need to verify your identity first.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page.

Contact

If you have any questions about this Privacy Policy or your data, email us at privacy@hitthosting.com.

By mail: Extant 2000 LLC, 7051 Brookfield Plz, PO Box 41, Springfield, VA 22150, USA