HASP and CCPA
HASP is a service provider under the California Consumer Privacy Act, contracted by the business that determines the purposes of processing California consumers' personal information. Every paid tier — and the Free Evaluation tier — gets the same service-provider contract, the same consumer-rights tooling, and the same no-sale / no-sharing commitments.
HASP processes personal information for you, not for us
Under Cal. Civ. Code §1798.140, your organization is the business — you decide why and how California consumers' personal information is processed. HASP is a service provider (and, where the relationship qualifies, a contractor) — we process that personal information only to deliver the platform you contracted for, under a written agreement that satisfies §1798.140(ag)(1).
That written agreement is the HASP Data Processing Agreement (DPA). It applies to every customer — self-serve, business, and enterprise — and is incorporated by reference into the Terms of Service. It is the single instrument that handles both the CCPA / CPRA service-provider obligations and the GDPR controller-processor obligations. HIPAA obligations are handled separately by the Business Associate Agreement (BAA).
What the DPA commits HASP to under CCPA
- Purpose limitation
- HASP processes personal information only for the business purposes documented in the DPA — providing the HASP platform, supporting customers, securing the service, complying with legal obligations. No secondary uses, no inference about consumers outside the contracted purpose.
- No sale
- HASP does not sell personal information as defined in §1798.140(ad). The DPA contains an explicit prohibition. No advertising auctions, no data brokerage, no monetary or other valuable consideration for personal information.
- No sharing
- HASP does not share personal information for cross-context behavioral advertising as defined in §1798.140(ah). No identifier graphs, no audience syncs, no advertising partners.
- No combining
- HASP does not combine personal information received from one customer with personal information received from another customer, or from any source outside the documented business purpose. Tenant isolation is enforced at the database and application layers.
- Annual certification
- The DPA includes the §1798.140(ag)(1) certification: HASP certifies that it understands the restrictions above and will comply with them.
- Audit cooperation
- HASP will, on reasonable notice and at the customer's expense, support reasonable assessments to verify compliance — including making documentation, sub-processor information, and control evidence available. The full procedure is at §11 of the DPA.
The mechanisms behind every California right
HASP does not receive consumer rights requests directly in most cases — the business receives them and uses HASP's tooling to honor them. Every paid plan and the Free Evaluation tier include the full set of mechanisms below.
Right to know
Machine-readable export of every category of personal information HASP processes about a consumer, the sources, the business purposes, and the categories of third parties (sub-processors) to which it has been disclosed. Self-service from the account dashboard.
Right to delete
Account deletion triggers a 30-day cascade across primary storage, encrypted backups, and direct sub-processors. The same mechanism that satisfies GDPR Article 17 erasure. §1798.105(d) exceptions (legal compliance, fraud detection, internal use compatible with consumer expectations) are documented in the Privacy Policy.
Right to correct
In-app correction by the consumer (where they hold an account) or by an account administrator acting on their request. Corrections propagate to backups within the next backup cycle.
Right to opt out of sale / sharing
Not engaged. HASP does not sell or share personal information, so the §1798.135 opt-out notice and Global Privacy Control honoring requirements are satisfied by non-engagement rather than by a working opt-out flow.
Right to limit use of SPI
Sensitive personal information is processed only for the §1798.121(a) permitted purposes — providing the requested service, security, fraud prevention, ensuring quality of the service. Never for inference about a consumer outside those purposes.
Disclosure obligations
Categories of personal information collected, sources, purposes, and retention periods are disclosed in the Privacy Policy. The 12-month look-back disclosures required by §1798.130(a)(5) are available on request via [email protected].
SPI is contained, not mined
California's definition of Sensitive Personal Information in §1798.140(ae) covers government identifiers, account credentials, precise geolocation, racial or ethnic origin, contents of communications, genetic data, biometric identifiers used for identification, health information, sex life or sexual orientation, and information about a known child. HASP's posture is the same across every category: process only for the §1798.121(a) permitted purposes, never for inference outside those purposes.
- Credentials
- HASP is passwordless — we do not collect or store passwords. OAuth tokens used to connect customer data sources are encrypted at rest with AES-256-CBC and accessible only to the connecting tenant.
- Health information
- PHI is detected at the AI gateway. Organizations configure whether PHI passes through, is anonymized before reaching an inference provider, or is blocked entirely — the policy is the customer's choice. PHI handling is not delegated to third parties. A signed BAA is required to enable PHI handling for an organization.
- Contents of communications
- Customer content (chat messages, uploaded documents, AI prompts and outputs) is processed only to operate the service. It is never used to train models, never sold, never shared.
- Geolocation
- HASP does not collect precise geolocation. IP addresses are processed for security and rate limiting and are not used to derive a consumer's precise location.
Sub-processors and downstream recipients
CCPA service-provider status requires that every downstream recipient of personal information accept the same restrictions HASP does. Every direct sub-processor is listed publicly on our sub-processors page and in §5 of the DPA, with processing purpose, data categories, and storage region.
- Flow-down
- Every sub-processor contract obligates the sub-processor to the same §1798.140(ag)(1) restrictions HASP accepts — no sale, no sharing, no retention beyond the business purpose, no combining with other sources.
- Advance notice
- 30 days' advance notice before adding or materially changing a direct sub-processor. Customers may object during the notice period; HASP will work in good faith to resolve objections or, where no acceptable alternative exists, allow the affected portion of the service to be terminated.
- Endpoint monitoring scope
- Our 24/7 endpoint monitoring service receives only availability data — no customer or consumer personal information — and is therefore not a sub-processor under CCPA.
CCPA is universal, not a tier feature
HASP's compliance posture is a floor at every paid tier and at the Free Evaluation tier — not a feature gated to Enterprise. The DPA, the consumer-rights tooling, the no-sale / no-sharing commitments, the sub-processor flow-down terms, and the security controls that back them up all apply uniformly. The Trust Center documents the full posture.
The corollary: a California buyer evaluating HASP does not need to choose a higher tier to get a service-provider contract or the consumer-rights primitives. Enterprise differentiation is about the dedicated data plane, region selection, SSO enforcement, retention, and procurement workflow — not about whether CCPA is honored.
CCPA / CPRA — frequently asked
Is HASP CCPA / CPRA compliant?
Is HASP a 'business', 'service provider', or 'contractor' under CCPA?
Does HASP sign a service-provider contract?
How does HASP support California consumer rights?
Does HASP sell personal information or share it for cross-context behavioral advertising?
What about Sensitive Personal Information (SPI)?
How are sub-processors and third-party recipients documented?
Does HASP support a Global Privacy Control (GPC) signal?
How does HASP handle California consumer requests received directly?
Where is CCPA / CPRA compliance offered — on which plans?
Adjacent frameworks and reference material
GDPR
European data protection — controller / processor model, Article 17 erasure, Article 20 portability, Standard Contractual Clauses for transfers.
HIPAA
Business Associate Agreement, PHI handling at the AI gateway, breach notification, and the relationship between PHI and CCPA Sensitive Personal Information.
SOC 2
Substrate-inherited Type II report from our compliance substrate, available under NDA. HASP's own direct engagement scheduled.
HITRUST CSF
Posture inherited from the compliance substrate, attestation letter available under NDA, direct certification on the roadmap.
PIPEDA
Canadian federal privacy law — ten fair-information principles satisfied by the same controls as GDPR, with cross-border transfer accountability discharged through the DPA.
Data Processing Agreement
The single service-provider / processor contract that satisfies CCPA, CPRA, and GDPR. Published and incorporated by reference into the Terms of Service.
Sub-processors
Every downstream recipient with processing purpose, data categories, and storage region. 30-day advance notice before any change.
Privacy Policy
How HASP handles personal information collected directly from account holders, billing contacts, and marketing leads — separate from customer-controller data.
Trust Center
The full posture — frameworks, controls, sub-processors, data flow inventory, and audit verification recipe — in one place.
California privacy contacts
Service-provider contract execution, sub-processor questions, assessment requests, pre-filled privacy questionnaires.
For HASP's own first-party processing. Customer end-user requests should be directed to the business that holds the account.
Countersigned DPA, custom assessment scope, dedicated data plane and region selection, SSO enforcement.