Server-side AES-256-GCM encryption. Complete tenant isolation.
OneHazel encrypts all PII and API credentials with AES-256-GCM, using per-operator key derivation, and TLS 1.2+ in transit. By completely isolating data via strict row-level security and per-operator boundaries, we drastically reduce your GDPR liability profile.
Data Architecture
Your PII and API credentials are encrypted with AES-256-GCM using a key derived per operator, and strict row-level security keeps every operator's data walled off from the next.
Encryption
AES-256-GCM for all PII and API credentials, with per-operator key derivation. Encrypted at rest and in transit via TLS 1.2+.
Data Residency
Your data is stored in London, UK — lawful under UK GDPR adequacy — and encrypted at rest with per-operator key derivation. Request processing runs in the region closest to the caller, so compute is not pinned to one jurisdiction. Specific residency requirements can be written into the DPA.
Tenant Isolation
Strict row-level security and per-operator boundaries keep your data completely separated. Your data is never co-mingled with another customer's, which drastically reduces your GDPR liability profile.
Your data, under your control
Compliance is not a document you request once a year. These are tools built into the platform.
Self-serve data export
Operators can export their own data, including player records, events and state, through the API at any time. Exported PII is decrypted so the export is actually portable.
Right to erasure
A single request anonymises your operator record, revokes API keys, deactivates connections and drops your dedicated data schema.
Operator audit log
Account-level actions taken against your data, by your team or by OneHazel staff, are recorded to an audit log you can query yourself, not just one we keep internally.
Recoverable deletes
Connections and workflows are not destroyed the instant you delete them. Deleted resources stay recoverable for 90 days before permanent removal.
Every connector is tested before it reaches you
Every build is validated against automated test suites before deployment, and flagged for a Human in the Loop if the agent cannot solve it.
Human in the loop
Every AI-generated connector is validated against automated test suites before deployment. When the agents hit an edge case they cannot resolve, the build is flagged for review by our engineers before it ships.
Connector drift detection
When an upstream vendor changes their API without notice, OneHazel detects the drift and repairs the connector automatically, reducing the operational burden of keeping every integration working.
Incident response
Incidents affecting your data or service are disclosed to affected customers. Current platform status is available at onehazel.com/status. Published uptime and response-time commitments are on our roadmap as part of a wider enterprise compliance programme; today, incident handling is a practice, not yet a contractual SLA.
Compliance roadmap
OneHazel is not currently SOC 2 certified. A formal SOC 2 Type II audit is on our roadmap as our enterprise customer base grows. Today, security is enforced through the encryption, isolation and data-control architecture on this page, and evidenced through our Data Processing Agreement.
GDPR Data Processing Agreement
OneHazel acts as a Data Processor for your operator data. You remain the Data Controller. We process data solely for the purposes of delivering the OneHazel platform services as described in your agreement. Our DPA covers: