Skip to main content
Data Security and Reliability

Encryption, Infrastructure, and Data Location

Encryption, customer environment isolation, data centres, and secure access from user devices.

Last updated 13 days ago

This article explains how Hanna protects data in transit, where customer data is stored, and how customer environments are separated.

Data in transit

Connections to Hanna use HTTPS, and data in transit is encrypted with TLS 1.2 or later. This applies when users work through a browser or mobile device and when systems exchange data through the API.

HTTPS protects information from being read or modified in transit. Users must still verify that they are opening their organisation's genuine Hanna address, especially when following a sign-in link from an email or message.

Data at rest

Sensitive user data is encrypted at rest. Passwords are protected with a one-way cryptographic hash and an individual salt, so Hanna employees cannot read user passwords.

Use the password recovery process if a password is forgotten. Never send Hanna Customer Support a current or proposed password, a one-time 2FA code, a recovery link, or an API key.

Isolated customer environments

Each Hanna customer uses a separate, isolated environment. Data separation helps prevent one customer's information from being accessible to another. Infrastructure-level safeguards against unauthorised access and continuous monitoring provide additional protection.

Data location

Customer data is stored in European Union data centres with physical and network safeguards. Service providers that may process data on Hanna's behalf are disclosed in the subprocessor list.

For a detailed data transfer assessment, consult the Hanna Trust and Reliability page and the current privacy documents. Your organisation should complete its own legal assessment against its requirements and signed agreement.

Secure access from devices

  • Use a supported, up-to-date browser and operating system.
  • Do not ignore browser warnings about certificates or insecure connections.
  • Do not save credentials on public or shared devices.
  • Lock an unattended device, and sign out after using a shared device.
  • Protect exported files according to your organisation's data classification and retention policies.

Was this helpful?

Still need help? Ask the team