How Hanasand protects monitoring data today.

Customer data handled

Hanasand stores the information needed to monitor watched companies and route alerts: organization identifiers, watchlist terms, user roles, webhook destinations, alert records, delivery status, and operational audit context.

• Watch terms can include company names, domains, suppliers, brands, executives, aliases, and portfolio companies.
• Alert records can include matched term, actor/company fields, source name, timestamps, confidence labels, status, delivery result, and analyst notes.
• Operational telemetry can include request IDs, route health, error state, rate-limit events, audit events, and service logs.

Safety boundary

The default buyer workflow is intentionally metadata-first. Customers should not need to upload raw leak dumps, malware, production credentials, or unnecessary personal data to receive company exposure alerts.

Access controls

Protected dashboard routes require authentication. Organization pages use member/role context for shared watchlists, alert scope, webhook destinations, and admin workflows. Enterprise identity requirements should be raised before purchase so SSO and provisioning scope are explicit.

Operational controls

The product exposes status, delivery history, admin/support flows, and readiness checks where the backing services are enabled. Security reviewers should verify the exact controls in the target deployment before relying on them for policy.