Security Isn't an Afterthought. It's in Our DNA.

Cybersecurity threats evolve constantly, and each new vulnerability is a reminder of the responsibility technology providers have to protect the organizations that depend on them.

Consider the critical PHP vulnerabilities disclosed in October 2026. The haku application does not use PHP, so these particular application-level vulnerabilities do not directly affect our core platform. But any technology stack can face new threats.

For organizations relying on technology to manage data, operations, and revenue, these risks are understandably concerning.

The reality is that no technology is entirely without risk.

Being unaffected by a particular vulnerability isn't what makes a platform secure. What matters is having the practices, processes, and accountability to continuously identify and manage security threats.

Security has to be embedded in how a platform is built, operated, monitored, and improved, not revisited only when security concerns make headlines.

At haku, security is part of our DNA.

Security Is a Continuous Commitment

For the endurance and nonprofit organizations we serve, technology connects far more than individual transactions.

It connects participants, donors, volunteers, members, and the financial and operational systems behind their communities.

Behind every interaction is someone's personal information. And behind every organization is a community that depends on its technology working reliably and responsibly. We take that responsibility seriously.

Our investment in technical safeguards, operational processes, and independent oversight reflects that responsibility.

How We Put Security Into Practice

Security requires layered safeguards: proactive technical risk management, independent validation, resilient infrastructure, and clear accountability.

Here is how we put those safeguards into practice.

Our security practices	What it means for our customers
SOC 2 Type II examination	Independent examination of controls within our SOC 2 scope over time
Penetration testing	Proactively identifying potential vulnerabilities through simulated attacks
Continuous compliance monitoring with Drata	Continuous compliance oversight, evidence collection, and control monitoring—not a substitute for technical threat detection
Encryption and access controls	Protecting sensitive information and restricting unauthorized access
Security threat monitoring, vulnerability management, and patching	Monitoring emerging threats, assessing potential impact, prioritizing remediation, and applying security updates
Secure and resilient infrastructure	AWS infrastructure designed to support availability, scalability, and reliability
Payment security	Supporting secure payment processing through Stripe and maintaining applicable payment security controls
Security awareness and training	Building security accountability throughout our organization

Independent Validation Through SOC 2 Type II

haku has successfully completed its SOC 2 Type II examination, providing an independent assessment of the design and operating effectiveness of controls within the examination’s scope over an established period.

This gives our customers additional confidence that our security practices aren't simply promises. They're subject to independent examination.

Penetration Testing and Continuous Threat Management

Our security work does not begin when a vulnerability makes the news.

We conduct annual third-party penetration testing, with additional testing after significant changes, to help identify weaknesses. Alongside that testing, we continuously monitor for emerging vulnerabilities and security threats, assess potential impact on our environment, prioritize remediation based on risk, and apply security updates as appropriate.

These are distinct but complementary activities: penetration tests probe for weaknesses, while continuous monitoring and vulnerability management help us evaluate and respond as the threat landscape changes.

Continuous Compliance Monitoring With Drata

Drata supports ongoing compliance oversight through automated evidence collection and monitoring of control status. It helps us demonstrate that governance and compliance practices are maintained over time.

This compliance monitoring is different from our technical security monitoring, which focuses on identifying threats, assessing exposure, and driving remediation.

Protecting Sensitive Information

Our security program includes encryption of personal data in transit and at rest, role-based access controls, and multi-factor authentication to help protect sensitive information from unauthorized access.

We also maintain controls designed to support the secure processing of payments and compliance with applicable payment security standards, including PCI DSS.

Infrastructure Security and Reliability

Security also includes operational resilience.

Our infrastructure is built on AWS, with monitoring, redundancy, and scalability designed to support platform availability and operational resilience.

Security Awareness Across Our Organization

Security also depends on people.

Our security program includes employee security awareness training and access management procedures that help reinforce a culture of accountability.

Protecting customer information is a shared responsibility across haku.

Security Is an Ongoing Commitment

Certifications, examinations, and compliance frameworks are important. But they are not the finish line.

Independent examinations offer important assurance, but no certification eliminates risk or replaces day-to-day security operations.

Our commitment is to maintain effective controls and improve our security practices as technology and threats evolve.

That's the commitment we make to our customers.

Built for the Trust You've Earned

The organizations we work with spend years building trust with their participants, donors, supporters, and communities.

That trust matters.

And we believe your technology partner should be just as committed to protecting it as you are.

As technology and expectations evolve, so will our security program.

Our commitment to protecting the organizations and communities that rely on haku won't change.

Because at haku, security isn't an afterthought.

It's in our DNA.

Reference: PHP Security Releases (October 2026).