Last updated: February 2026
HansaChat is following best practices in the security world. Please note that the application is currently still in the early phase and not all planned security measures are implemented.
HansaChat is running exclusively on Hetzner cloud servers. It runs on several different zones (Falkenstein and Nuremberg) on a private Kubernetes cluster. All data physically remains in Germany.
We use HTTPS and TLS. Your data is encrypted between your browser and our servers. Your provider or any other man-in-the-middle cannot see it.
All your data, such as user details or messages, will be stored in a self-hosted MySQL instance. It is located within the private Kubernetes network and password protected. It is not possible to access the database outside of the Kubernetes network. The database is located on an encrypted volume using Longhorn volume encryption.
All free and demo users have shared infrastructure. All paid workflows have their own database.
As of February 2026, all files are stored on self-hosted MinIO, located on encrypted volumes as well.
This is expected to change and Hetzner Object Storage will be used at a later point. We plan to use SSE-C when uploading your files to Hetzner storage. See more details about SSE-C here.
HansaChat, as the platform operator, has the technical capability to access workspace data, including emails, messages, and channel memberships, strictly for maintenance, troubleshooting, or legal compliance. We respect your privacy and do not access your data without consent or necessity.
As of February 2026, there are no backups and disaster recovery. The app is not production ready and only available for testing.
Backups will be encrypted at rest, stored in multiple zones, and tested regularly once production-ready.
As of February 2026, HansaChat is using Sentry for error handling and monitoring. This is expected to change in favor of self-hosted options such as Loki/Grafana.
No PII data is being collected.
HansaChat is collecting only basic information such as your browser name, country and visited pages. We do not log IP addresses or any information that may identify you. All the information stored in the self-hosted service and not transfered to any third parties.
As we host our services in Germany and operate within the European Union, we are fully committed to GDPR compliance. This includes:
We take security seriously and are happy to answer any questions you may have about our security practices, data handling, or compliance.
If you discover a security vulnerability, please report it to us responsibly by emailing igor@hansa.chat. We will investigate all reports and work to address any issues promptly.