Hannah Subprocessor List
CWS uses the providers below to deliver Hannah. A provider is a subprocessor if it processes personal information on CWS's behalf in delivering Hannah to a customer.
Core subprocessors
These providers are used for every Hannah customer.
| Provider | Service | Information it may process |
|---|---|---|
| Microsoft Azure | Application hosting, databases, and storage (production) | All Hannah service data: uploaded documents, employee details, conversations, form submissions, and logs |
| Anthropic | AI processing | Employee questions, Hannah's answers, relevant conversation context, excerpts from uploaded documents, Special Instructions, and information retrieved from a connected TimeOut account. Form answers filled out in chat and employee profile details. Employee email addresses, when answer quality review runs. Full documents when the Hannah Review or Smart Forms analyzes them |
| Twilio | Sign-in codes by SMS and email; service email delivery | Phone numbers, email addresses, sign-in codes, delivery details, and email content, which can include completed form PDFs |
| Voyage AI | Search indexing of documents and questions | Passages from uploaded documents and employee questions |
| Stripe | Payment processor | Credit Card information |
Subprocessors used only with certain features
These providers apply only when the feature is turned on or a customer connects the channel.
| Provider | Used when | Information it may process |
|---|---|---|
| ElevenLabs | Voice answers are turned on | The text of answers being read aloud |
Changes to this list
CWS will give notice of material additions or replacements as set out in its Terms of Service. CWS will email Customer’s designated account administrator at least fifteen (15) days before adding or replacing a subprocessor that processes Customer Personal Data, except where an earlier change is reasonably needed for security, legal compliance or continuity, in which case notice will be given as soon as reasonably practicable. Customer may object in writing within ten (10) days after notice on reasonable, documented data-protection grounds. Questions: support@cws-software.com
Version: 1.0