Security at RevOps HQ

RevOps HQ builds and operates revenue operations software and HubSpot integrations for our clients. Protecting the data our clients trust us with is part of how we build every product. This page explains how we keep that data secure.

Hosting and infrastructure

Our production systems run on DigitalOcean in its New York (NYC3) data center in the United States, and customer data is stored in that region only. Our databases are DigitalOcean managed database services, which handle server maintenance and automated backups.

Production runs in its own private network. Development happens on separate machines, and no development or test systems share the production network.

Data encryption

Data sent to and from our applications is encrypted in transit using TLS. Data stored in our managed databases is encrypted at rest.

Network security

Production servers sit behind a firewall that blocks all inbound traffic by default. Only web traffic is open to the internet. Administrative access to servers is limited to a short list of approved company locations and uses key-based authentication. Password login is disabled. Firewall rules are reviewed at least once a year.

Access control

Access to production systems and customer data is granted on a least-privilege basis, only to staff who need it for their role, and removed when someone leaves or changes role.

Application security and vulnerability management

Our code is stored in GitHub and continuously scanned for known vulnerabilities in its dependencies. Our policy requires critical and high-severity vulnerabilities to be fixed within 30 days, medium within 60 days and low within 90 days. Public-facing production systems are scanned at least quarterly.

Monitoring and incident response

Production servers are monitored for intrusion attempts and unexpected changes to system files, and alerts reach our team in real time.

We maintain a documented incident response plan covering detection, containment, investigation and recovery. If an incident affects your data, we will notify you.

Business continuity and backups

Our databases are backed up daily. Logs are retained for 90 days. We maintain a business continuity plan.

Data retention and deletion

We keep customer data only as long as we need it to provide our services or meet legal obligations. When a client’s contract ends, we delete their data within 30 days. Anyone can ask us to delete their personal data using our data deletion request form.

Our people and policies

Our security program is defined in written policies covering information security, access control, data management, cryptography, secure development, operations security, incident response and business continuity. Policies are reviewed at least once a year.

Everyone who joins accepts these policies and completes security awareness training, and repeats that training every year. New hires undergo a background check.

Compliance

We use Vanta to continuously monitor our security controls, and we are working toward SOC 2 and ISO 27001, with a target of 1 December 2026. We do not yet hold either certification.

Subprocessors

We use the following third parties to store or process customer data:

Companies that process personal data collected on this website are listed in our privacy policy.

Report a security issue

If you believe you’ve found a security vulnerability in any RevOps HQ product or website, please email paul@revopshq.com with enough detail for us to reproduce it. We’ll acknowledge your report and keep you updated while we investigate. Please don’t access other people’s data, disrupt our services, or share the issue publicly until we’ve fixed it.

Last updated 28 October 2026