Security & GDPR
HANC is built for European businesses: core processing and storage run in the EU, international transfers are disclosed, and your Data Processing Agreement is one click away in the dashboard. Full compliance documentation lives in the trust center at security.hanc.ai.
Where your data lives
| What | Where |
|---|---|
| Platform and call handling | Hetzner data centre, Germany (Nuremberg) |
| Main database — agents, call details, transcripts, CRM records, campaign contacts | MongoDB Atlas, Frankfurt, Germany |
| Speech recognition and the language model | Microsoft Azure, EU (Sweden) |
| Call recordings | Microsoft Azure storage, EU |
Our hosting providers' data centres are ISO 27001 certified. Hanc.AI itself does not hold ISO 27001 or SOC 2.
Part of the processing can take place outside the EU — for example, ElevenLabs voices are synthesised in the US when you pick one, and sign-in uses Firebase Authentication (Google) as a global service. Every such sub-processor, its location and the transfer mechanism are listed in the sub-processor list and the Privacy Policy. To keep voice synthesis in the EU, do not pick an ElevenLabs voice.
Encryption
- In transit: TLS 1.2 / 1.3 on all product domains, HTTP is redirected to HTTPS, TLS 1.0 / 1.1 are rejected. Browser calls from the widgets use WebRTC with mandatory encryption.
- SIP trunks: transport and media encryption (TLS / SRTP) can be set per trunk. See Phone Numbers.
- At rest: the main database and call-recording storage are encrypted (AES-256).
- CRM keys and tokens you enter in Integrations (CallRail, monday.com, GoHighLevel, Kommo) are stored encrypted and are not exposed in the workflow builder.
DPA and sub-processors
Your Data Processing Agreement (English and German editions) and the current sub-processor list are in the dashboard: avatar menu → Payment Plan → Legal tab. These documents have no public address — they are provided there and on request at privacy@hanc.ai.
The same section links the Terms of Service, the Privacy Policy and the full compliance documentation.
EU AI Act
Article 50 of the EU AI Act requires that callers know they are talking to artificial intelligence.
The platform does not add this notice automatically. Put it in the agent's first message or at the start of the workflow — for example, "Hello, this is the AI assistant of Example GmbH." If you record calls, add a recording notice too; many countries require consent. See Settings → Call recording.
You remain responsible for how you use the agent: no practices prohibited by Article 5 of the AI Act, and telemarketing rules for outbound campaigns.
Deleting and exporting data
| Task | How |
|---|---|
| Delete the account | Avatar menu → Profile → Danger zone → Delete account, then type DELETE. Your account is deactivated, phone numbers are released and the subscription is cancelled. Call history and other data stay stored; to have all data erased, write to privacy@hanc.ai. |
| Export contacts | CRM → Contacts → Export CSV |
| Export call logs | Dashboard or the agent's Dashboard tab → Export to XLS |
| Other requests (access, correction, full export) | Write to privacy@hanc.ai |
Microsoft Marketplace and Azure
HANC is available on the Microsoft Marketplace. Enterprise customers can buy HANC through their Microsoft Azure Consumption Commitment (MACC). See Billing → Enterprise.
Related
- Billing & Subscriptions — plans and the account settings
- Team — who in your company can see what
- Settings — call recording and post-call analysis