HannaWorks
HANNA WORKS / SECURITY

Private isn’t a promise.
It’s the architecture.

Your records are read on your infrastructure. Bring the questions your security review would ask. We’ll answer them against a running deployment.

Bring your security questions
THE BOUNDARY

The perimeter
is yours.

One installation for your organisation. Locally hosted models. Access checks enforced in the database.

These protections describe the self-hosted configuration. If you configure an external model endpoint or cloud storage, your chosen provider and network policies define that boundary.

YOUR NETWORK BOUNDARYSelf-hosted configuration
01Your recordsFiles · mail · archives
02Your libraryIndex · access · audit
03Your AILocal inference
Records + question + answerStay inside.
01 / INFERENCE

Your model.
Your hardware.

Local model serving keeps document text and questions inside your network. Model IDs and providers are configuration you control.

02 / RECOVERY

The files remain
the source of truth.

The object store holds the originals. The catalog, extracted fields and search index are derived, and can be rebuilt from those records.

03 / ISOLATION

Access enforced
below the interface.

Database row-level security applies the tenant boundary. Search applies document access before ranking and answering.

06 / CONTROL THAT GOES DEEPER

Trust the answer.
Control the access.

Permissions come first.

Access rules filter the search before documents are ranked. People only receive answers grounded in records they are allowed to see.

Reads leave a record.

Every search and document access can be recorded in an append-only, hash-chained audit trail. Verification detects changes to that trail.

A legal hold takes priority.

A held document cannot be disposed of by a retention schedule, an erasure request or an administrator. Blocked attempts are recorded.

People approve disposal.

Retention rules propose disposal. A person reviews and approves the action before the system destroys anything.

Sensitive fields stay covered.

Configured fields are masked in the interface and exports. A permitted role must explicitly reveal a protected value.

PERMISSIONS, MADE VISIBLE
HR

Employee record

Illustrative record · Sensitivity tier 3
Name
A. Okonkwo
Employee ID
EMP-004182
Base salary
Government identifier
  Restricted
A permitted reviewer can explicitly reveal salary. This viewer cannot.

Document opened. Access recorded.

Audit event

An interactive illustration of access rules. No employee data is connected.

EVIDENCE FOR YOUR REVIEWER

Ask for the proof.
We’ll bring it.

Review the actual mechanisms, configuration and operating procedures behind the claims.

01

A record of who read what and when, with the audit verification tool.

02

The decision log: design choices, dated, with what was measured.

03

The operations manual, backup scope and recovery procedures.

04

An access-isolation test, run against your deployment.

05

Your configuration for sensitivity, retention and field visibility.

06

A walkthrough on your hardware, with your network rules in place.

A CLEAR STATEMENT ON ASSURANCE

Designed for scrutiny. No certification claimed.

There is no SOC 2 report, ISO 27001 certificate or independent penetration-test report being claimed here. If a specific certification is a procurement requirement, raise it on the demo call. Your security team should assess the deployment against your own obligations.

ACCESSIBILITY STATEMENT

Built for every reader.
However you work.

HannaWorks aims to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA across this website.

What this website supports

  • Keyboard and switch access. Every link and control works from the keyboard, in a logical order, with a visible focus ring and a “Skip to content” link.
  • Screen readers and voice control. Pages use landmarks, one main heading and an ordered heading outline. Controls are named with the words you see on them, icon buttons have spoken names, and the interactive examples announce their changes.
  • Larger text and zoom. Text is sized in relative units, so it follows your browser zoom and text-size settings. Pages reflow to a 320-pixel-wide screen without sideways scrolling.
  • Motion. A “Pause motion” control on every page stops the animations, and the website remembers your choice. If your device is set to reduce motion, animations start paused. Nothing flashes.
  • Colour and contrast. Text meets AA contrast in the light and dark themes. Selected options are shown by shape or weight as well as colour. Increased-contrast, reduced-transparency, forced-colour and inverted-colour settings are respected.

Known limitations

  • The animated search diagram is a visual illustration. Its five steps are written out beside it as buttons you can select, but the moving squares themselves are not described one by one.
  • On narrow screens, the provider cost comparison table scrolls sideways inside its own box.
  • “Book a demo” prepares a message for your own email app. If that doesn’t suit you, email or call us directly.
  • The HannaWorks application behind “Log in” and the external sites we link to are not covered by this statement.
  • This website has been checked by our own team with automated tools in two browser engines, keyboard-only use, and simulated settings for larger text, reduced motion, increased contrast and forced colours. It has not yet been reviewed by an independent auditor, and no certification is claimed.

Tell us what doesn’t work

  • If anything on this website is hard to use, email connect@hanna-ai.ca or call +1 (647) 524-3894, Monday to Friday, 9am to 6pm ET.
  • Tell us the page and what happened. We’ll reply, help you get the information another way, and work on a fix.

Statement prepared 7 October 2026.

YOUR RECORDS, ANSWERING.

The answer is already
in your records.
Let’s find it.

Start with a library you choose. We’ll size the hardware with you and show you the citation behind every answer.

See it answer your records