Last updated: 25 October 2026
How we protect the Dexter app, HoD Business and the data in them. This page describes what is in place today. We'll keep it up to date as we add more.
Hosting and data location
- Account, pet and business data is stored on our servers in India (Mumbai), hosted by Hostinger.
- AI requests go to Amazon Bedrock (AWS). AWS doesn't use them to train models.
- The full list of providers is on our Service providers page.
Protecting data
- In transit: all connections to our apps and APIs use HTTPS (TLS). Plain HTTP is redirected.
- Passwords: stored only as salted one-way hashes (bcrypt). We never see or store your password in readable form. Sign-in codes expire quickly and are rate limited.
- Access control: every request is checked against the signed-in account. HoD Business data is separated by business, and each business controls which staff can see which branches and modules.
- Pet Passport: only the details a pet parent switches on are shared, access can be time-limited and revoked, and every scan is logged.
- Uploads: location metadata is removed from photos posted to the community. Documents are processed only for the feature you asked for.
- Secrets: API keys and credentials are kept on the server, never in the apps.
Operations
- Backups: the hosting provider keeps weekly server backups, and the oldest is replaced when a new one is made.
- Staff access: only people who need it to run the service can access production systems, using individual, temporary keys that are removed after use.
- Updates: server security updates are installed automatically.
- Testing: changes are tested automatically before release, including tests for account deletion, consent and data access between accounts.
Incidents
If a personal data breach affects you, we'll tell you and the authorities as the law requires. HoD Business customers are told within 48 hours of us becoming aware, as set out in our Data processing agreement.
Report a security problem
Email support@houseofdexter.com with "Security" in the subject. Please give us a reasonable chance to fix the problem before sharing it, don't access or change other people's data, and don't disrupt the service. We won't take legal action against good-faith research that follows these rules.