Security & Privacy
Security & Privacy
Security is the foundation of Hansestack. Our architecture is designed so that we are technically incapable of knowing your users' passwords.
Privacy via k-Anonymity
We utilize the principle of k-Anonymity to guarantee full GDPR compliance.
- Local Preprocessing: Before any request is sent to our servers, your system hashes the password (e.g., via SHA-1).
- Prefix Transfer: You only transmit the first 5 characters of the hash to us. A 5-character prefix (e.g.,
004C7) is never unique; it is shared by millions of different passwords. - Anonymous Response: We send back a list of all hash endings (suffixes) that start with this prefix. The final verification takes place in isolation on your server.
Result: We never see the plaintext password and never see the complete hash.
Infrastructure & Data Sovereignty
- Location: Our servers run exclusively in Germany within ISO 27001 certified data centers operated by Hetzner Online GmbH.
- Zero Cloud Act: Because Hansestack is an independent German private project with no US ties, we are not subject to the US CLOUD Act. Access by US authorities is impossible.
Data Minimization (Log Policy)
We do not store any Personally Identifiable Information (PII) from API requests:
- No Query Logs: The transmitted 5-character prefixes are not logged long-term in the context of user sessions or requesting IP addresses.
- Telemetry: We only collect aggregated metrics (e.g., API calls per hour) to enforce the portal's rate limiting.
Vulnerability Disclosure
We highly value the work of the security community. If you discover a vulnerability in the API or the developer portal during the Beta phase, we kindly ask for responsible disclosure.
- Send an email to security@hansestack.de
- Alternatively: Report the vulnerability via the "Private Vulnerability Reporting" feature in our GitHub Feedback Repo. Please do not open a public issue for security-critical bugs!