Compliance & Security
HackFury is committed to maintaining the highest security standards. Below you will find our current external security validations, privacy alignments, and control-focused compliance references.
How we verify
Independent third-party scans (ImmuniWeb, Qualys SSL Labs, Mozilla HTTP Observatory) run against the live production domain, not a staging copy.
CIS benchmark review runs directly on the production host configuration, with findings remediated before this page lists it as passing.
Privacy baselines (GDPR, CCPA/CPRA) are checked against the live privacy notice and the actual access/export/delete tooling users can run today.
Each badge links to the live, third-party-hosted report or a downloadable certificate - not a static claim only we control.
ImmuniWeb Website Security Test
Independent external assessment of the platform's web security posture, including SSL/TLS configuration, HTTP headers, GDPR & PCI DSS compliance checks, and vulnerability scanning.
Qualys SSL Labs
Independent SSL/TLS analysis for the HackFury public platform, validating certificate quality, protocol support, transport configuration, and external HTTPS hardening posture.
Mozilla HTTP Observatory
Independent scan of the platform's HTTP security headers, covering Content-Security-Policy, HSTS, cookie flags, and referrer/permissions policy - currently graded A+.
CIS Level 1 Server Benchmark Reviewed
HackFury completed a production review against the Ubuntu USG profile cis_level1_server-v2.0.0, with the benchmark passing after minor findings were remediated on the live server.
CCPA / CPRA Aligned Privacy Baseline
HackFury maintains the core California privacy baseline for notice at collection, consumer-rights handling, correction / deletion / export flows, service-provider disclosures, and documented backup-retention handling.
GDPR-Aligned Privacy Baseline
HackFury maintains GDPR-aligned privacy controls covering transparency in our privacy notice, data subject rights, export and deletion tooling, retention disclosures, strictly necessary cookies, and consent-based newsletter communications.