Your website, and your customers, kept safe
How we protect your website, your data and your customers' details, in plain words. Share this page with your IT or procurement team.
Hosted on Cloudflare
Every page over an encrypted connection, on a global network with DDoS protection built in. Cloudflare holds SOC 2 Type II and ISO 27001.
Payments by Stripe
Cards are taken by Stripe, certified PCI DSS Level 1. Card numbers never reach our systems.
No passwords to steal
Sign-in is a one-time link to your email. Our own admin also needs a code from an authenticator app.
Backed up every day
Daily copies kept 30 days, point-in-time recovery for 30 days, and deleted photos recoverable for 30 days.
NZ Privacy Act 2020
A plain privacy policy, your data to download or delete from your account, and a breach plan.
A New Zealand company
HATTECH Limited, Christchurch. Our agreement is under New Zealand law, in plain words.
Hosting and infrastructure
Websites, databases and photos run on Cloudflare (Workers, D1 and R2). Cloudflare is independently audited to SOC 2 Type II and certified to ISO/IEC 27001; its reports are on its Trust Hub (cloudflare.com/trust-hub).
Every page is served over HTTPS, and browsers are told to use only HTTPS for our addresses (HSTS). Cloudflare's network absorbs denial-of-service attacks before they reach a site.
Each website we make runs as its own isolated program with its own database, so one site can't read another's. Data is encrypted at rest by Cloudflare.
Payments
All payments go through Stripe Checkout and Stripe's billing page. Stripe is a PCI DSS Level 1 service provider, the highest level. We never see, receive or store a card number: we keep only the card's brand, last four digits and expiry, to tell you which card a payment came from.
Banks can ask for 3D Secure confirmation, and Stripe's fraud screening checks every payment. A card change in the billing page moves your payments to the new card straight away.
Signing in and access
There are no passwords. Signing in sends a link to your email that works once, for 20 minutes; only a fingerprint (hash) of it is stored, so our database alone can't sign anyone in. Signing out ends the session.
A website's own admin is opened with a link signed by that site's private key. HATTECH's admin page needs the emailed link and a six-digit code from an authenticator app, with single-use recovery codes. Only HATTECH's owners can use it, and changes are logged.
Keys that shop owners give us for their own payment accounts are sealed with AES-256-GCM encryption, with a key kept outside the database.
Backups and recovery
Every day the main database and each website's words are copied to separate storage and kept for 30 days. The database also keeps 30 days of point-in-time recovery. A website's words can be put back as they were on any of those days, and a deleted photo can be brought back for 30 days.
Protecting your customers
Messages sent through a website's contact form go only to that business. Robots and link-stuffed spam are filtered out before they reach anyone's inbox.
Websites we host use no advertising or tracking cookies, and we don't sell or share anyone's details.
New free websites are screened for the signs of a scam before they go up, and anyone can report a website to us; reported sites can be taken offline the same day.
Reliability and monitoring
Our systems check themselves every hour: email delivery, payments, backups and the sites themselves. Anything that fails is flagged to us straight away, and the service has a health check for outside monitoring.
Urgent problems are answered within four working hours (8am to 6pm, Monday to Friday, New Zealand time), and everything else within two working days.
Privacy and compliance
We follow the Privacy Act 2020: our privacy policy says what we hold, why, for how long, and who helps us. From your account you can download everything on your website in one file, or delete your account and everything in it. If a privacy breach ever risked serious harm, we would tell you and the Privacy Commissioner as soon as we could, as the law requires: we keep a written plan for it.
Our website service agreement is in plain words under New Zealand law, with 30 days' notice of any price change and no fee to leave. Every payment comes with a receipt as a PDF, which can go to your accounts team.
Who helps us
We give each of these only what it needs to do its part. They may hold information outside New Zealand, under their own security and privacy terms.
| Provider | What for | Independent certification |
|---|---|---|
| Cloudflare | Hosting, databases, photos, backups; drafts a new site's words with AI from what you tell us | SOC 2 Type II, ISO/IEC 27001 |
| Stripe | Card payments, the billing page, and the record of every payment | PCI DSS Level 1, SOC 2 |
| Resend | Sending our emails (sign-in links, receipts, notices) | – |
| GitHub | Keeping the code and words of each paid website, privately | SOC 2 |
How long we keep things
| A free mock-up not taken up | Deleted 30 days after it ends, with a week's warning |
| A website whose subscription ends | Kept 30 days in case you come back, then deleted, with a week's warning |
| Daily backups | 30 days |
| Deleted photos | 30 days, then gone for good |
| Your account | Until you delete it, from your account |
| Payment records | Seven years, as New Zealand tax law requires, held by Stripe |
Being straight with you
HATTECH is a small New Zealand company. We don't hold a SOC 2 or ISO 27001 certificate of our own: we build on providers who do, keep what we hold to the minimum, and protect the rest as set out above. If your business has a security questionnaire, we're happy to fill it in: ask us.
Found a security problem?
Please tell us straight away, and give us a chance to fix it before telling anyone else. Report a security problem: it reaches us at once, and we'll reply and keep you posted. Our details for researchers are also at /.well-known/security.txt.
Last reviewed 17 October 2026.