Security
Security
Protecting members from impersonation matters as much as protecting servers. Here is how to spot real Huntos contact and how we handle data.
Recognise genuine email
- Sign-in and operational messages come from [email protected] or other addresses ending in @huntos.hn or @huntos.cloud — never from free webmail pretending to be Huntos.
- Links should point to huntos.hn paths you expect (for example /sign-in, /claim). Hover before you tap.
- Huntos does not send unexpected attachments. If a message pushes you to open a file or install software from elsewhere, it is not us.
- Magic sign-in links expire in about fifteen minutes and require a button press in the email.
Passwordless sign-in
There are no Huntos passwords to steal. You enter your email; we email a one-time link. That reduces phishing — but you must still guard your inbox. If you did not request a link, ignore it and report suspicious mail.
How we protect data
- TLS encryption in transit between your browser and our servers.
- Sensitive fields such as tax numbers stored encrypted at rest.
- Audit logging on security-relevant actions.
- Hosting in Germany for core infrastructure.
Details evolve as systems launch; material changes will appear in /privacy.
Responsible disclosure
If you believe you found a security vulnerability, email [email protected] with enough detail to reproduce the issue. Please do not test against live member data without permission.
Report impersonation
Fake sites, bogus payment requests, or messages claiming to be Huntos should be reported to [email protected] and to your local scam authority. See /trust for CERT NZ, Action Fraud, ReportFraud.ftc.gov, and Scamwatch links.