Security
Security at Host Little
How we protect your site, your data, and your customers' trust. Concrete practices — not marketing claims.
Encryption in transit and at rest
Customer-facing sites are served over HTTPS with managed TLS certificates.
We use encryption and access controls appropriate to the systems we operate; customers remain responsible for protecting their own application secrets and data configuration.
Restore support
Support-assisted recovery paths are included for hosted sites and approved hosted projects.
Restores are a support request away — we do them with you.
Magic-link sign-in. No passwords stored.
We don't store passwords for customer accounts. Sign-in uses a one-time link sent to your email.
Nothing to guess, leak, or reuse. No forgotten-password flows to phish.
Isolation and access control
Each customer's WordPress site runs in isolated services with its own database.
Access to production systems is limited to authorized operators for support and platform operations.
Where your data lives
US East and US West regions, with CDN, SSL, and DDoS protection on the edge.
We don't sell or share customer data with third parties beyond the sub-processors required to operate the platform. The current sub-processor list is below.
Incident response
We assess and investigate suspected security incidents and notify affected customers without undue delay after confirming an incident affecting their data.
Service-impact updates are published on /status when appropriate to the incident.
Data deletion
After cancellation, production data is normally retained for up to 30 days to support export or restoration, then removed from production systems subject to legal-retention needs.
Backup copies age out on their applicable retention schedule.
Data Processing Agreement
DPAs are available on request.
Email us and we'll send you the current template.
Sub-processors
The service categories we rely on to run the platform, as of June 2026:
Payment processing for billing and payments.
Transactional email delivery for customer project mail.
Host Little account and notification email delivery.
Application and site compute infrastructure.
DNS, CDN, SSL, and DDoS protection infrastructure.
Security scope
We operate for high availability, monitor customer-facing services, and alert affected customers during incidents. For formal SLA, audit, or compliance requirements, email [email protected] and we'll confirm the right support path before you buy.