Skip to main content
Data Security and Reliability

Security Incidents, Vulnerabilities, and FAQs

How to report an incident or vulnerability, with answers to common security questions.

Last updated 13 days ago

Use this article to report a suspected security incident, vulnerability, or unusual activity and to find answers to common security questions.

How Hanna manages incidents

Hanna maintains a documented process for recording, assessing, escalating, mitigating, and recovering from security incidents. Affected customers are notified promptly of significant incidents as required by applicable law and contract.

Security vulnerabilities are assessed and monitored regularly. Critical patches are prioritised, and threats are continuously evaluated and remediated.

Reporting a possible incident

When contacting Hanna Customer Support, include:

  • your organisation's Hanna address;
  • the date and time with time zone;
  • the affected module, user, or integration;
  • exactly what you observed and the actions already taken;
  • error text or a screenshot without secrets or unnecessary personal data;
  • when relevant, the API method, path, response code, and a safe request identifier.

Never send passwords, one-time 2FA codes, password recovery links, API keys, session cookies, or other sign-in secrets. Revoke or replace any secret that may have been exposed before contacting support.

Reporting a vulnerability

Do not exploit a vulnerability beyond what is necessary to confirm it, and do not attempt to access another party's data. Tell Hanna Customer Support which address or function is affected, the reproduction steps, potential impact, and a safe way to exchange additional details. Do not publish technical details before Hanna has assessed and remediated the issue.

Frequently asked questions

Is Hanna certified to an information security standard?

Yes. Hanna's information security management system is certified to ISO 27001:2022.

Where is customer data stored?

Customer data is stored in European Union data centres, and customer environments are separated and isolated.

Can Hanna employees read user passwords?

No. Passwords use a salted one-way cryptographic hash and cannot be read. A forgotten password must be reset.

Can we enable 2FA?

Yes. Organisations can use two-factor authentication and manage its application to employees.

How long are activity logs retained?

Activity logs are retained for at least 12 months.

Does Hanna create backups?

Yes. Backups are created regularly and stored in different geographic locations. Major incident recovery objectives are RTO up to 12 hours and RPO up to 6 hours.

Does Hanna have professional and cyber insurance?

Yes. Hanna states that it holds cover of up to EUR 1,000,000 per incident, valid worldwide, through an A+-rated Lloyd's of London insurer. Cover includes professional errors, data breaches, and privacy violations. Check the Hanna Trust and Reliability page for current details.

Was this helpful?

Still need help? Ask the team