Headroom Labs
Trust & Security
Last updated June 28, 2026
Security at Headroom Labs starts with the architecture: the Headroom product runs inside your own environment, and your prompts, tool calls, and code never reach us. This page summarizes that model, our security program, our sub-processors, and how to request our full documentation package.
Documentation
Public documents you can read now:
- Security Overview — how we secure the product and our operations
- Architecture & Data Flow — where your data goes (and doesn’t)
- Sub-processors
- Privacy Notice
Our security program
Headroom Labs maintains a set of company-wide security policies that apply to every product we ship (currently the Headroom OSS proxy/CLI). The full text is available to customers and prospects under NDA — see Request the full package below.
| ID | Policy | Summary |
|---|---|---|
HL-SEC-001 | Information Security Policy | Data classification, control commitments, and how we protect confidentiality, integrity, and availability across the company. |
HL-SEC-002 | Secure Software Development Lifecycle | How code is reviewed, tested, scanned, signed, and released — the OSS pipeline is public on GitHub. |
HL-SEC-003 | Access Control & Password Policy | Least-privilege access to source, CI/CD, cloud, and registries; authentication and credential handling. |
HL-SEC-004 | Incident Response Plan | Severity tiers, roles, and the coordinated process for detecting, containing, and disclosing incidents. |
HL-SEC-005 | Risk & Supply-Chain Management | Dependency governance, vulnerability management, and software supply-chain controls. |
HL-SEC-006 | Business Continuity & Disaster Recovery | Recovery objectives and continuity for the company’s own systems. |
HL-SEC-007 | HR Security & Acceptable Use | Personnel security, onboarding/offboarding, and acceptable-use controls for everyone with access. |
Secure development
Headroom is open source, so our development practices are visible: code review on every change, automated security scanning and dependency checks in CI, and signed, reproducible releases. Our vulnerability disclosure process is published in SECURITY.md, and you can review the codebase and release pipeline on GitHub.
Sub-processors
Because the product is on-premises and we never receive customer content, Headroom Labs uses no sub-processors to process customer data. We do rely on a small number of providers to run our website and distribute the software.
Privacy
Our Privacy Notice describes what the website collects and how we handle personal data. For the on-premises product, customer content does not transfer to us at all, so there is no cross-border transfer of that content through Headroom Labs.
Compliance status
We are an early-stage company building toward formal attestation. We do not yet hold a SOC 2 or ISO 27001 report; our controls are documented in the policy set above and mapped to standard vendor-assessment frameworks (e.g. SIG, CAIQ). We are happy to complete security questionnaires and share our control mappings under NDA. As the managed/SaaS offering matures, the program will be extended with the additional controls a multi-tenant data-processing environment requires.
Reporting a vulnerability
Report suspected vulnerabilities to security@headroomlabs.ai (acknowledgement target: 48 hours). Machine-readable contact details are published at /.well-known/security.txt.
Request the full security package
Customers and prospects can request our full documentation set — the complete security policies, completed security questionnaires, and architecture/data-flow detail — under a mutual NDA. Email security@headroomlabs.ai and we will share the package.
Request security packageContact
Security & privacy: security@headroomlabs.ai
Headroom Labs, Inc.136 Paso Olmo Terrace
Fremont, CA 94539
United States