Trust

Everything a security reviewer or procurement team needs about HAQQ, in one place: what we publish, where the contractual text lives, and what has to be requested from a person.

Published documents

These are live URLs, not documents available on request. Each one is the operative text, not a summary of it.

HAQQ trust and compliance documents
Document	What it covers	Where
Privacy notice	Personal data processed, roles of the parties, lawful basis, data-subject rights, transfers, retention and deletion.	haqq.ai/privacy
Data processing agreement	Processor obligations, sub-processors, security measures, international transfers, audit rights, breach notification.	haqq.ai/dpa
Security overview	Encryption, tenant isolation, access control, and the no-training-on-your-data position.	haqq.ai/security
Terms of service	The controlling agreement. Book III is the data-protection book and operates as the DPA.	haqq.ai/terms-and-conditions
Service status	Current availability of the services and the recent uptime record.	Status

Compliance frameworks

HAQQ implements and maintains security, privacy and governance controls designed to align with applicable professional, regulatory and technical standards, including the frameworks referenced in Book III of the Terms.

Compliant, not certified — and we would rather say so

HAQQ is compliant with SOC 2, ISO 27001, ISO 42001 and GDPR: our controls are built and operated against those frameworks. HAQQ is not currently certified against them — we do not hold a SOC 2 Type II report or an ISO certificate, and you should not treat anything on our site as claiming otherwise.

That distinction matters in a security review and most vendors blur it, so here it is in the one place a reviewer will look. If your procurement process requires a certificate rather than a control set, tell us early — it is a real constraint and we would rather fail your requirement in week one than in week six.

Any statement that HAQQ holds, maintains, or renews a particular certification, attestation, audit report, or compliance status applies only to the extent such certification, attestation, audit report, or status has been formally obtained, remains current, and covers the relevant Products and processing activities.

Sub-processors

HAQQ engages sub-processors to deliver the services. Section L of Book III sets out the categories, the obligations imposed on them, and your right to object to a new one within fifteen days of notice. The categories are:

Cloud hosting and infrastructure providers
Data storage providers
AI infrastructure providers
Identity and authentication services
Payment-interface providers
Communications providers and support systems
Analytics providers and security tooling

Data residency and transfers

Regional data residency is available where it has been committed in an order form, official proposal or platform configuration. Cross-border transfers may occur where necessary for support, security, billing, sub-processor services, redundancy, legal compliance or operation of the services, and rely on adequacy decisions, standard contractual clauses, UK addenda, or equivalent lawful mechanisms. Section N of Book III governs this.

Coverage and residency are separate questions — being served in a country does not by itself mean data is processed there. The country coverage statement is published at haqq.ai/coverage.

Audit and compliance evidence

Section O of Book III sets out what compliance evidence HAQQ makes available and the conditions under which an audit can be requested. Security questionnaires, evidence packs and audit requests go to the same place as any other procurement question.

Breach notification

Section P of Book III sets out what constitutes a personal data breach, the notification path, the timelines and how the parties share breach-management costs. Operational availability and incident history are on the Status page.

Reaching a human

Security questionnaires, DPA execution, sub-processor lists, certification evidence and vulnerability reports all route through haqq.ai/contact. There is no separate security-only address to guess at.