Built to pass your DPO’s questions.
Honch handles business data carefully, transparently and within the law. Everything your data protection, security and procurement teams need is on this page, including the documents to download.
Safe by design, not by policy alone.
These rules are built into the platform itself, so they hold every time.
Your data stays yours
Every request is scoped to your own account. There is no way to reach another client’s data, by design.
Read-only in your AI
Honch in your AI can only read, and only what your own login can see. It can’t change, delete or send anything.
Send-only mailboxes
Honch never reads your inbox. Connected mailboxes are used to send the emails you approve, nothing else.
Encrypted at rest
Mailbox and CRM connection tokens are encrypted at rest, and connections are shared within your account only by choice.
Suppression on every read
Opt-outs and your client lists are applied on every search, export and CRM push, not just when an email sends.
Evidence, not guesswork
Every signal shows where it came from, so nothing reaches you on an invented reason.
Everything your DPO needs, in one place.
Download our policies, agreements and statements, or request the ones we share directly. Anything missing? Email dpo@honch.co and we’ll send it.
Privacy & data protection
Sub-processor list
Every third party that processes data on our behalf, by purpose. October 2026.
DownloadData sourcing & transparency
Where our data comes from, how people are notified, and how opt-outs work. January 2026.
DownloadLegitimate interests assessment
Our 2026 balancing test for processing business contact data.
Request a copySecurity
Information security & risk management
Our controls for access, encryption, hosting, testing and incident response. October 2026.
DownloadBusiness continuity & disaster recovery
How we recover from server failure or data loss, with our recovery targets.
DownloadSecurity questionnaire
Send us your questionnaire or supplier form and we’ll complete it.
Send it to usResponsible business
Policies & contracts
Everyone in Honch is told, before they’re included.
Business contact data comes from public sources and licensed suppliers. Here’s how we make sure the people behind it know, and can say no.
Notified first
Before anyone is added to the live database, we send a privacy notice to their business email address.
Delivery checked
We confirm the notice was delivered. If it wasn’t, the contact is excluded.
48 hours to object
We wait 48 hours. Anyone who opts out in that window is never added.
Reminded every 3 months
A reminder goes out every three months, with an easy way to object at any time.
Suppressed for good
Opt-outs are recorded and suppressed, so they can’t be reintroduced from another source.
The controls behind the platform.
A summary of our information security and risk management policy. Download the full document for your supplier review.
MFA on every internal account, role-based access and least privilege. Access removed the day someone leaves.
AES-256 encryption at rest and TLS in transit. Full-disk encryption on every laptop.
UK-based, ISO 27001 certified data centres, with daily backups and Azure DDoS and web application firewall protection.
Independent penetration testing at least once a year, vulnerability scanning and OWASP Top 10 practices.
Real-time monitoring and intrusion detection, with event logs kept for at least 12 months.
A defined response plan, a one-hour initial response target and client notification within 48 hours.
Business continuity and disaster recovery plans, tested every year, with a 48-hour recovery objective.
Every critical supplier risk-assessed every year and held to our security and privacy standards.
Business data, processed properly.
Honch processes business contact data so that our clients can find and contact the right people at the right companies. Here’s the detail your DPO will ask for.
Questions your DPO would ask? Send them.
Security questionnaires, DPAs and supplier reviews are part of the job. We’d rather answer them before the contract than after.
Trust questions
Where does Honch’s data come from?
Public professional profiles, company announcements, social posts, job adverts and company filings. We process business contact data, not personal consumer data.
Can someone ask to be removed?
Yes. Anyone can exercise their rights through our DPO. Objections are suppressed permanently, across every search, export and CRM push.
Does Honch read our email?
No. Connected mailboxes are send-only. Honch sends the emails you approve and never reads your inbox.
Can Claude see other clients’ data?
No. Honch in your AI signs in as you and is read-only, so it can only see what your own login can see.
Will you sign our DPA?
Yes. We have a standard DPA ready, and we’re happy to review yours.