> ## Documentation Index
> Fetch the complete documentation index at: https://hercules.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Learn how Hercules protects your apps and data through encryption, tenant isolation, access controls, secure development, monitoring, and incident response.

Protecting your apps and data is central to how we build Hercules. Our founders' last company, Fig, was acquired by Amazon Web Services (AWS). Review our security controls in the [Trust Center](https://trust.hercules.app).

### Does Hercules encrypt my data?

Yes. Data is encrypted in transit and at rest. Access to encryption keys is restricted to authorized personnel with a business need.

### Does Hercules isolate my data from other customers?

Yes. Organizations' apps, data, and development environments are isolated. One app cannot access another app's data through Hercules's infrastructure.

### Who at Hercules can access customer data?

Production access is restricted to authorized personnel who need it for their work. We review access at least quarterly and revoke it when employees leave. Support access is limited to what is needed to investigate an issue.

### How does Hercules protect secrets?

Credentials are encrypted and access is restricted. Keep your app's API keys in [Secrets](/docs/apps/secrets), rather than in source code or frontend code.

### How does Hercules secure software changes?

Software and infrastructure changes go through testing and review before production deployment. Automated checks scan code and dependencies, and only authorized personnel can deploy changes.

### How does Hercules monitor for threats?

We monitor production services for errors, availability, and suspicious activity. Our security procedures cover vulnerability management, system monitoring, and escalation.

### How does Hercules respond to security incidents?

We follow documented incident-response procedures to investigate, contain, and resolve the issue. Incidents are tracked and communicated to affected parties as required. We test our incident-response plan at least annually.

### How does Hercules review vendors?

We assess vendors that handle customer data and maintain written confidentiality and privacy commitments. See our [subprocessor list](https://trust.hercules.app/subprocessors).

### How do I secure the app I build?

Configure [sign-in rules](/docs/apps/users-auth/sign-in-rules) and [roles and permissions](/docs/apps/users-auth/users-roles-permissions), and run a [security audit](/docs/apps/security). Review generated code and integrations before publishing.

### How do I report a vulnerability?

Email [security@hercules.app](mailto:security@hercules.app) with the affected service and steps to reproduce. Do not access other customers' data or disrupt the service.

### Additional FAQ

<AccordionGroup>
  <Accordion title="Where can I review audit reports and certifications?">
    See [Compliance Certifications](/docs/enterprise/compliance-certifications) and our [Trust
    Center](https://trust.hercules.app).
  </Accordion>

  <Accordion title="How does Hercules handle privacy and data retention?">
    See [Data Privacy](/docs/enterprise/data-privacy) for ownership, AI training, retention, and
    deletion.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.