This page lists what actually protects event data in HeySignal. It ends with our certification status, in one plain sentence. That's it.
Every event arrives with an HMAC-SHA256 signature over its data and consent state. Our edge recomputes that signature and compares it in constant time. Signatures older than five minutes are refused, so a captured request cannot be replayed later. The full mechanism is documented on the consent gate page.
When verification fails, or anything is ambiguous or broken, the event is blocked with a typed 403 block reason. Nothing is forwarded on error. Silence is not a pass.
Each processed event carries a consent proof ID, persisted in an audit log. When someone asks whether an event had consent, the answer is a record, not a shrug.
Personal data in an event is SHA-256 hashed or stripped at the edge. What a destination does not need, it never receives.
Events are captured and verified on Bunny.net edge nodes at European points of presence. Storage runs on OVHcloud managed Postgres and Valkey in France and Germany. No US provider sits in the data path.
Every provider that can touch event data is on our public subprocessor list. The full infrastructure story is on the EU-only infrastructure page.
HeySignal holds no security certifications yet. SOC 2 Type II is planned for Q4 2026. We would rather tell you that than imply otherwise with a badge wall.
If your DPO or security team has questions this page does not answer, email us. You will get answers, not a portal.
BRAND