Data Stored In Germany.Authenticated Listeners.Aggregated Analytics.
This page describes how Hypecast handles certification, hosting, identity, audio access, analytics and sub-processors, for information security, data protection and procurement reviews.
What IsCertified?
- ISO 27001 certified.
- GDPR compliant.
The certificate and the compliance documentation are part of the documentation package described below. The privacy policy and imprint name the controller and the legal entity.
Where IsData Stored?
All customer data is stored in Germany. Processing takes place within the European Union.
Where a customer requires a different geographic location, one can be provided. The location is agreed in writing before the workspace is set up.
Who CanSign In?
Hypecast supports single sign-on and SAML, so employees authenticate through the identity system your organisation already runs.
Access inside the platform is role-based. Publishing, approval, workspace administration and reporting are separate permissions and can be assigned per workspace, so a business unit sees and manages only its own shows.
Who CanListen?
Listeners are authenticated. An episode is available to the people you address and to nobody else.
There is no public RSS feed by default. Where a feed is needed, for example for a podcast app, it is a private feed tied to the individual listener. A public feed is an explicit choice for shows that are meant to be public.
Why this differs from a podcast hosting tool is explained in hosting vs platform. Delivery inside Microsoft Teams uses the same authenticated model.
What IsMeasured?
Reporting is aggregated only. You see reach, listen-through and return listening per show, episode and audience group. No named-listener record is created and no report shows what an individual employee has listened to.
This model is designed for works council review. The level of aggregation and the retention period can be documented in a works agreement where one is required; the details are covered in the documentation package below.
Who ElseProcesses Data?
Sub-processors are listed in the data processing agreement (DPA), which is part of every customer contract. The current list is available on request. Changes are notified in advance in line with the DPA.
What Do We ProvideFor The Review?
Most internal podcast projects go through a data protection review, a works council consultation, or both. We provide the material these reviews ask for, so the project does not wait on documents.
- Security documentation package, including the ISO 27001 certificate.
- Data processing agreement (DPA) with the sub-processor list.
- Sample data-flow description covering upload, storage, delivery and reporting.
- A description of the analytics model for the works council file.
- A contact for questions from your DPO or information security team.
Security:Frequently Asked Questions.
Is Hypecast ISO 27001 certified?
Yes. Hypecast is ISO 27001 certified. The certificate is part of the security documentation package and can be requested through the contact form.
Where is our data stored?
All customer data is stored in Germany and processed within the EU. If your organisation requires a different geographic location, one can be provided and is agreed before the workspace is set up.
Can employees sign in with our existing identity system?
Yes. Hypecast supports single sign-on and SAML. Listeners authenticate through your identity system, and access within the platform is role-based.
Is there a public RSS feed?
Not by default. Listeners are authenticated, and where a feed is needed it is a private feed tied to the individual listener. A public feed is only used for shows that are meant to be public.
Can anyone see which employee listened to an episode?
No. Reporting is aggregated only, per show, episode and audience group. No named-listener record is created.
What do you provide for a works council or DPO review?
A security documentation package, the data processing agreement with the sub-processor list, a sample data-flow description and a description of the analytics model. Request it via the contact form and we will send it to your DPO or works council contact.
Documentation ForYour Review.
Certificate, DPA, sub-processor list and data-flow description in one package, sent to your information security, data protection or procurement contact. More about the company on the company page.