Hyperproxy Security & Trust Center

Hyperproxy uses a shared multi-tenant account, billing, and orchestration control plane. Each active subscription receives a dedicated proxy data plane and static IP. No application process or secret store is shared between subscriptions. This describes application and secret-store separation; it is not a claim of exclusive physical hardware.

Public control-plane secret APIs are write-only and return secret names and metadata, not values. Stored secret values use AES-256-GCM encryption. Encryption keys are wrapped separately from stored ciphertext, and decryption happens only in the controlled proxy runtime for approved request injection.

Auto-Auth replaces configured placeholders at the proxy boundary. Host-scoped bindings limit where a stored credential may be injected. Firewall mode can inspect TLS traffic and evaluate CEL allow, deny, or hold rules; source IP restrictions are an additional option. These controls are policy inputs, not a guarantee that every permitted API operation is safe.

Access logs record request metadata, policy decisions, and outcome fields without recording secret values. Secure shares are bearer capabilities scoped to a vault, expiry, and use count. Possession can authorize requests until the share expires or is revoked; downstream API authorization and response sensitivity remain the customer’s responsibility.

No public SOC 2 certification, public penetration-test report, uptime SLA, or compliance attestation is claimed as of this review date. This is a status statement, not a roadmap promise. A public subprocessor list requires owner approval. Procurement requests for current evidence can be sent through the contact page.

Credential separation reduces direct secret-read exposure; it cannot make an allowed API action safe by itself or prevent a permitted upstream response from containing sensitive data. Customers should use least-privilege upstream credentials, narrow host bindings and rules, protect proxy credentials and share URLs, review logs, and revoke access when it is no longer needed.