Security
Honest, not impressive
Hookmill is a pre-seed product. Here is exactly what we do to protect your account and your brand, and where we still have work ahead of us.
Encrypted in transit
Every connection to Hookmill runs over HTTPS with modern TLS. There is no plaintext path for your brand kits, account details, or generated concepts as they move.
Scoped access, least privilege
Production access is limited to the people who operate the system. We do not hand out broad admin access by default, and support does not open your account without a reason tied to your request.
Your content is not used to train models
Your brand kits, prompts, and generated concepts go to a model provider only to produce your output, under terms that exclude training on your content. We do not build shared datasets from customer data.
Deletion on request
Delete a brand kit or your account and the associated data is removed from our primary store. Ask support if you want confirmation once it is done.
Dependency and secret hygiene
We keep dependencies current, keep API keys and credentials out of source control, and rotate secrets when a provider or a team member changes.
Where we are
What we have not earned yet
We are early, and we would rather say so than borrow credibility we have not earned. Hookmill does not hold SOC 2 or ISO certifications and has not completed a third-party security audit. As the company and the customer base grow, we plan to pursue formal certifications and a public audit, and this page will say so plainly when that happens.
Responsible disclosure
Found a vulnerability?
Email help@gethookmill.com with what you found and how to reproduce it. We read every report, do not pursue good-faith researchers, and will credit a fix if you want the credit.
Make a week of ads before your coffee gets cold
The free plan generates three full concepts a month: on-brand visual, hook, primary text, and headline, sized for every platform. No card, no watermark on the ideas.