Trust and Security at Humantic AI
Humantic AI is a Buyer Intelligence platform. Where our data comes from, how we secure it, and where every legal document lives.
We hold ourselves to the highest levels of security, and comply with every major privacy and AI framework and law: SOC 2 Type 2, the GDPR, the EU AI Act, the CCPA, India’s DPDP Act and more.
- SOC 2 Type 2
- GDPR
- EU AI Act
- CCPA
- India DPDP Act
- Virginia CDPA
Where Our Data Comes From
Buyer Intelligence starts with what people and companies choose to publish. This map shows where our data comes from and where it ends up.
Sources
Public professional data
What a person has chosen to publish on public platforms: name, designation, work history, education, interests and posts.
Data partners
Only partners we have verified have the legal basis to share the data with us.
What your team adds
The text, documents and personal data your team sends us. We process these on your behalf, and only for you.
- Controllerof the public data we gather, under our Privacy Policy.
- Processorof the data your team sends us, on your instructions only.
Where it goes
Your workspace
Insights reach your team in the app, the API and MCP. External signals your team adds stay in your workspace and are never added to public profiles.
Or nowhere, on request
Anyone can opt out. We remove their profile and keep them on a do-not-disturb list, so we do not process their data in future.
What we never use: Private communications and restricted data sets.
If Humantic AI Has a Profile of You
You can see it, fix it, limit it or remove it. You do not need an account to ask.
Remove your profile
Enter your email, social username, LinkedIn URL or phone number on our opt-out page. Once we verify the request, we remove your profile and stop processing your data.
Go to the opt-out page Visited a site that uses Visitor ID? You can opt out of Visitor ID website visitor identification on the same page.- See and correct your data
- Ask to access the data we hold about you, and have anything that is wrong corrected.
- Object or restrict
- Tell us to stop or limit how we process your data.
- Erase it
- Ask us to delete your personal data.
- Complain
- Raise a concern with your data protection authority at any time.
To use any of these rights, write to our privacy contact. Personality and DISC insights in a profile are AI predictions, not statements of fact.
Ready to try it? Your data stays in your workspace.
How We Handle Data
The commitments in our Data Processing Agreement and Privacy Policy, in plain words.
- Our 2 roles
- For public data we gather, Humantic AI is the controller. For data your team sends us, you are the controller and we are your processor: we act only on your instructions.
- Where it is processed
- Mainly in the United States. Transfers out of the EU, UK and Switzerland are covered by Standard Contractual Clauses in our Data Processing Agreement.
- Sub-processors
- Amazon Web Services (hosting and storage), OpenAI (analysis and text generation) and Amazon Bedrock (text generation). We give customers at least 15 days notice before adding or replacing one, and you can object.
- AI training
- We never use your data to train AI models. What your team sends us is used only to run Humantic AI for you, and our AI providers do not train on it either.
- Workspace isolation
- External signals your team adds stay inside your workspace. They are never added to public profiles.
- MCP and AI assistants
- Every MCP session needs explicit user sign-in, runs with the same permissions as the app, and only sees its own workspace.
- When you leave
- When a customer account ends, we keep the customer data for 30 days, then delete it, as our Terms and DPA set out.
- If something goes wrong
- If a breach touches your data, we tell you without undue delay, with what you need to meet your own obligations.
Security Practices
How we protect the data in our care, and how to tell us if you find a problem.
Independent audit
Our security controls are covered by a SOC 2 Type 2 audit report. Request the latest report on this page and our team emails it to you.
EU AI Act
Our AI systems are built and run in line with the EU AI Act, and we are open about which insights are AI predictions.
Internal policies
Policies on confidentiality, incident management, access control, endpoint security, data backup and vendor management.
People
Staff who handle personal data are trained on the principles of the GDPR and bound by confidentiality obligations. We redo our GDPR Legitimate Interests Assessment every 6 months.
Vendors
We check the security, privacy and confidentiality practices of our vendors before engaging them, and hold them to GDPR-equivalent obligations.
Privacy laws worldwide
We comply with the California Consumer Privacy Act (CCPA), the Virginia Consumer Data Protection Act (CDPA), India’s Digital Personal Data Protection Act (DPDP) and other major privacy laws.
Access for enterprise teams
Enterprise setup covers single sign-on (SSO) and role mapping.
SOC 2 Type 2, GDPR and EU AI Act compliant, and with every other major privacy law. Try it free, or ask us anything in a demo.
Compliance
What has been independently audited, and how we meet the GDPR, the EU AI Act and privacy laws worldwide.
GDPR
Compliant as a controller and as a processor, with named EU and UK representatives and a Legitimate Interests Assessment (LIA) redone every 6 months.
How we handle GDPR Request the LIA
EU AI Act
Our AI systems are built and run in line with the EU AI Act, and we are open about which insights are AI predictions.
Read the FAQ
Privacy laws worldwide
The CCPA, the Virginia CDPA, India’s DPDP Act and the other major privacy laws.
Read our Privacy PolicyRequest our security documents
Tell us who you are and our team emails them to you.
- SOC 2 Type 2 reportOur latest independent audit of our security controls.
- Legitimate Interests Assessment (LIA)Our GDPR assessment of the legitimate interests we rely on. Redone every 6 months.
Recognition
Awards from customers and analysts. They are not security certifications.
G2 Top 100 Highest Satisfaction, 2025
Gartner Cool Vendor in AI-Led Sales Research, 2024
Legal Documents
Every policy and agreement, with the date it was last updated.
- Terms of ServiceThe terms for using Humantic AI.
- Privacy PolicyWhat we collect, why, and your choices.
- GDPROur roles, legal bases and commitments under the GDPR.
- Legitimate Interests AssessmentOur GDPR LIA, redone every 6 months. Request it on this page.Request
- Data Processing AgreementOur DPA with EU, UK and Swiss transfer clauses and sub-processors.
- Opt outRemove your profile, or opt out of Visitor ID.Request form
- security.txtHow to report a vulnerability.
- legal.txtOur legal and privacy summary in plain text.
Questions for our team? Book a demo and ask them live.
Who to Contact
Use the address that matches your request.
Humantic AI
- Privacy and data requestsAccess, correction, erasure, our security policy
- LegalContracts, DPAs and legal notices
- Security documentsSOC 2 report and LIA: request them on this pageRequest the documents
Our GDPR representatives
- EU representativeRickert Rechtsanwaltsgesellschaft mbH
- UK representativeRickert Services Ltd UK
FAQs
-
From public professional data (profiles and posts on public platforms), from data partners that have the legal basis to share it, and from the data your own team adds. We do not use private communications or restricted data sets.
-
We hold ourselves to the highest levels of security and comply with every major privacy and AI framework and law, including SOC 2 Type 2, the GDPR, the EU AI Act, the CCPA, the Virginia CDPA and India’s DPDP Act.
-
Yes. Our controls are covered by a SOC 2 Type 2 audit report. Request it with the short form on this page and our team emails you the latest report.
-
We are the controller for public data we gather and the processor for data our customers send us. We redo our Legitimate Interests Assessment (LIA) every 6 months, and you can request it on this page. Our Data Processing Agreement includes Standard Contractual Clauses for EU, UK and Swiss transfers, and we have named representatives in the EU and the UK.
-
Yes. Our AI systems are built and run in line with the EU AI Act. Personality and DISC insights are AI predictions, and we say so wherever they appear.
-
Yes. We comply with the California Consumer Privacy Act (CCPA), the Virginia Consumer Data Protection Act (CDPA), India’s Digital Personal Data Protection Act (DPDP) and other major privacy laws, alongside the GDPR.
-
Yes. Our standard customer agreements include a DPA that applies automatically to personal data from the EU when you buy a license, and we can sign master service agreements and data processing agreements for GDPR and other requirements. Write to legal@humantic.ai.
-
Amazon Web Services for hosting and storage, OpenAI for analysis and text generation, and Amazon Bedrock for text generation. Customers get at least 15 days notice before a change, with the right to object.
-
Mainly in the United States. Amazon Web Services provides hosting and storage. Transfers from the EU, UK and Switzerland run under Standard Contractual Clauses.
-
No. We never use your data to train AI models. What your team sends us, such as CRM records, emails and lists, is used only to run Humantic AI for you, and our AI providers (OpenAI and Amazon Bedrock) do not train on it either.
-
At humantic.ai/optout. The person confirms their email with a one-time code, names the emails or profile link to remove, and gets a request ID to track it. We remove the profile within 15 to 20 minutes and add the person to a do-not-disturb list, so we do not process their data in future. Opted-out profiles return nothing through our API and integrations.
-
Email help@humantic.ai with enough detail to reproduce it. We reply within 5 business days, keep you updated, and take no legal action against research that follows our security.txt guidelines.
See Buyer Intelligence on Your Own Accounts
Bring your security team's questions to the demo.