> AI agents: the site index is at [https://hyperhuman.cc/llms.txt](https://hyperhuman.cc/llms.txt). Every page has a Markdown version, for example /pricing.md.

# Security, in one link.

## EU hosting. You control the data. We process it. Every answer, vendor, and document is right here.

[Request the DPA](https://hyperhuman.cc/en-au/contact)

[Ask a security question](https://hyperhuman.cc/en-au/trust?ask=1)

### At a glance

EU

Hosting, storage, and video on AWS Frankfurt

You

Control the data. We process it.

0

Names or emails needed

DPA

With Standard Contractual Clauses where required

No

Training on your private content without your opt-in

Never

Selling of personal data

Last updated: 2 November 2026.

### The answers

EU

## Where is data hosted?

On AWS Frankfurt, in the EU. That covers hosting, storage, backups, and video delivery. AI features run on Google Cloud, which can process data outside the EU. See AI and subprocessors.

You

## Who controls the data?

You do. For data you send through the API and Teams, your organisation is the controller. Hyperhuman is the processor. API customers agree to our DPA, with Standard Contractual Clauses where required. Need a copy? [Contact us](https://hyperhuman.cc/en-au/contact).

Ready to sign

## What does the DPA cover?

Our DPA sets out how we process your data. To get yours ready for signature, send your legal name, registered address, company number, and privacy contact through our [contact page](https://hyperhuman.cc/en-au/contact).

-   Standard Contractual Clauses, where required.
-   14 days' notice before a new subprocessor starts, with the right to object.
-   Breach notice without undue delay.
-   Deletion within 30 days of your written request after the agreement ends.
-   One remote audit per 12 months, on 30 days' notice.

Not needed

## Do you need names or emails?

No. We don't need to know who your users are.

-   Identify members with your own external ID.
-   Generate and recommend also work with anonymous profile attributes.
-   We store a basic profile (goals, age, level) only if you send it.

Optional

## How is health data handled?

You decide what to send. Health data powers fitness features. It is never used for marketing. HIPAA and a BAA are not included.

-   Injuries and limitations: optional free text when you adapt or generate a workout.
-   Activity, sleep, steps, and heart rate: optional health-data push.
-   Readiness is computed from the signals you send. It is not a field you submit.
-   Apple Health and Health Connect apply only if the user connects them.
-   ROOK wearable sync applies only if you enable it.

No training

## How does AI use our data?

AI features run on Google Cloud (Vertex AI and Gemini). They process the inputs you send, such as profile attributes, optional injury notes, and health signals, to generate and adapt workouts, write insights, and analyse videos. We do not use your private content to train general-purpose models unless you opt in.

-   We may use aggregated, de-identified analytics to improve features and safety.
-   CloneMotion makes silent exercise clips. No voice cloning.
-   AI can make mistakes. Review outputs before you publish.

In place

## What security is in place?

The measures in our [Privacy Policy](https://hyperhuman.cc/en-au/privacy), plus how your content is protected.

-   Encryption in transit (HTTPS/TLS)
-   Encryption at rest for databases, media files, and backups
-   Hardened networks
-   Access controls and key management
-   Endpoint protection and audits
-   API keys scoped to your organisation
-   Workout videos on time-limited signed URLs

Safeguarded

## When does data leave the EU/EEA?

When a vendor outside the EU/EEA processes it. Today that includes Google Cloud for AI, Grafana Cloud for monitoring, Intercom for support, and Mailchimp for email. We use adequacy decisions or Standard Contractual Clauses for these transfers.

You decide

## How long do you keep data?

While the account is active, or until you delete it. Backups and logs are kept for a limited period, then purged.

-   Backups run automatically several times a day to redundant, encrypted storage in the EU.
-   Ask us to delete data through our contact page. It completes within 10 business days.
-   Rights requests are handled within 1 month.
-   Members can delete their account in the app: Profile → Account → Delete Account.
-   Legal and financial records are kept where the law requires it.

We notify

## What if something goes wrong?

If an incident is likely to put people's rights at high risk, we notify you and the authorities, as the law requires. Found a vulnerability? [Contact us](https://hyperhuman.cc/en-au/contact). Our contact is also in [security.txt](https://hyperhuman.cc/.well-known/security.txt).

No

## Do you have ISO 27001 or SOC 2?

No. We don't hold ISO 27001, SOC 2, or ISO 13485 today. Enterprise can scope formal certifications. Send your security questionnaire in chat.

No

## Is Hyperhuman a medical device?

No. Hyperhuman is fitness and wellness software. It does not diagnose, treat, cure, or prevent disease. Content is not medical advice.

24/7

## What support and SLA do we get?

AI chat answers 24/7. Live uptime is on our [status page](https://hyperhuman.cc/status). Custom Enterprise adds a named team, SSO, and a custom SLA.

Monthly or yearly

## How do renewal and cancellation work?

Plans renew automatically, monthly or yearly, as you choose. Full details are in the [Teams Terms](https://hyperhuman.cc/en-au/legal-teams), sections 14 to 16.

-   Cancel in the app: Teams → Billing → Cancel Subscription.
-   Cancellation takes effect at the end of the current term. You keep access until then.
-   Yearly plans are a commitment for the full term.
-   Changed your mind after a renewal? Cancel and request a refund of the plan fee in the app within 2 days of the charge.
-   Export your data before the term ends. API keys are revoked after.

### Documents

[Request the DPA Ask for a copy, with Standard Contractual Clauses.](https://hyperhuman.cc/en-au/contact)[Security measures The technical and organizational measures we apply.](https://hyperhuman.cc/en-au/trust#security)[API Terms Where the DPA and Standard Contractual Clauses are referenced.](https://hyperhuman.cc/en-au/legal-api)[Privacy Policy What we collect, share, keep, and delete.](https://hyperhuman.cc/en-au/privacy)[System status Live uptime and incidents for the API and apps.](https://hyperhuman.cc/status)[security.txt Where to report a vulnerability.](https://hyperhuman.cc/.well-known/security.txt)[All terms Teams, API, and Club.](https://hyperhuman.cc/en-au/legal)

### Subprocessors

The vendors that process customer data. Optional tools apply only if you turn them on.

| Name | Purpose | Location | Applies when |
| --- | --- | --- | --- |
| Amazon Web Services | Hosting, storage, backups, and video delivery, including the CDN | EU (Frankfurt) | Always |
| Google Cloud (Vertex AI, Gemini) | AI features: workout generation and adaptation, insights, video analysis, translation, and voice | United States and global | When you use AI features |
| Grafana Cloud | Logs, metrics, and app monitoring | United States | Always |
| Intercom | Support chat | United States | When someone opens chat or contacts support |
| Mailchimp | Account, invite, and product emails | United States | When we email your team or members |
| Stripe | Payment processing. We do not store full card numbers. | See the vendor | When you take payments |
| Firebase | Crash reports and push notifications | See the vendor | Apps that use them |
| Google Analytics | Product analytics | See the vendor | Site and product analytics |
| ROOK | Wearable sync | See the vendor | Only if you enable wearables |
| Zernio | Social publishing you turn on | See the vendor | Only if you publish to social channels |
| YouTube | Publishing you turn on | See the vendor | Only if you connect YouTube |
| Wix | Site embeds you turn on | See the vendor | Only if you use Wix |

### More questions

Can we get a signed DPA?

Yes. API customers agree to our DPA, with Standard Contractual Clauses where required. [Contact us](https://hyperhuman.cc/en-au/contact) for a copy.

Is data encrypted at rest?

Yes. Databases, media files, and backups are encrypted at rest on AWS Frankfurt. All traffic is encrypted in transit with HTTPS/TLS. See all our security measures.

What end-user data appears in your logs?

Logs can include IP address, device and browser data, and API call events. Send a name or email only if you need to.

Can we export or delete member data?

Yes. Member data is available through the API. Pushed health and nutrition entries can be deleted through the API. Wider exports are handled on request.

How do members of our app delete their account?

In the app: Profile → Account → Delete Account. Or through our [contact page](https://hyperhuman.cc/en-au/contact). Deletion completes within 10 business days.

Do you sell personal data?

No. We do not sell personal data.

Can we opt out of de-identified analytics?

Not self-serve today. Custom data rules are part of Enterprise.

Is HIPAA included?

No. We are not a HIPAA business associate. A BAA is not included unless agreed in writing.

How are workout videos protected?

Videos stream from time-limited signed AWS URLs. API keys are scoped to your organisation. DRM and offline packages are not available.

Which privacy laws do you cover?

GDPR and UK GDPR, with hosting in the EU. You give your users the privacy notice and collect any consent you need. We process on your instructions.

What age limit applies?

The services are for users 18 and over.

Is there a native SDK?

No. The API is the integration. Typed clients can be generated from the OpenAPI spec. AI Motion uses the Asensei SDK inside your app.

### Explore more

[Capability checklist Nine operator requirements, and how each one ships.](https://hyperhuman.cc/en-au/capabilities)[Gyms Adaptive training for multi-site operators.](https://hyperhuman.cc/en-au/gyms)[Pricing Self-serve plans, then Enterprise.](https://hyperhuman.cc/en-au/pricing)[Contact Enterprise pricing and security questions.](https://hyperhuman.cc/en-au/contact?inquiry=custom)

Partner ecosystem

### Need implementation help?

Our integration partners and studios can help you go live faster with Hyperhuman.

[EXPLORE PARTNERS](https://hyperhuman.cc/en-au/partners)

Built for growth. Driven by intelligence. _Powered by AI._

[GET STARTED](https://team.hyperhuman.cc/welcome)

[CHAT WITH US](https://hyperhuman.cc/en-au?ask=1)

---

Source: https://hyperhuman.cc/en-au/trust