People whose data your organisation holds (members, contacts, the people your devices may observe) have rights over it: to see it, take it, correct it and have it erased. Hermetry gives you a request queue, a dossier of everything the platform holds about one person, and an erasure that runs across every module at once. This page explains the tools and what they do and do not cover. For Hermetry’s own processing terms see the data processing agreement and the privacy policy; for legal questions about Hermetry as a company, contact us.
Two kinds of data
| Data | Treatment |
|---|---|
| Personal data | Members’ accounts and profiles, their sessions and sign-in history, audit rows about them, notification records, contacts and other people’s data your organisation stores. Covered by dossiers and erasure. |
| Machine data | Devices, their attributes, telemetry, alarms and connection state describe machines. A person appears there only as a user id (for example who created a binding), which stops identifying anyone once the account is erased. Device addresses are kept 30 days in the connection log, are not exported and are not linked to a person. |
Free text you write on a device (its name, label, attributes) is your description of your machine. Keep personal names out of it.
Note
If your devices are carried or worn by people, such as personnel trackers, their positions and events can identify a person. Erasure does not search telemetry. Do not use personal names as device names, keep the tracker-to-person mapping outside device data, and rely on your telemetry retention (see How long data is kept).
Privacy requests
Open Privacy Requests (address /admin/privacy/requests). Admins can record, read and verify requests; building dossiers and running erasures needs the Owner role.
Record a request
- Select Record Request (Record a Privacy Request).
- Enter the Subject type (for example
USERfor a member,CONTACT), Subject id, Subject email, Subject name, the Right exercised and a Note. - Select Record. “The statutory deadline is stamped from today and does not move afterwards. Backdate the received date if the request arrived earlier.”
| Right | Answer |
|---|---|
| Access | A dossier: every module’s rows about the person, in one file |
| Portability | The person’s data in a portable format |
| Erasure | Deletion or anonymisation across every module |
| Rectification, restriction, objection | Handled by you in the module concerned; the request records the answer |
The queue shows Subject, Right, Status, Verified, Received and Due. Past deadline, still open shows the overdue ones.
Verify the person
“Blocks dossiers and erasures until someone has recorded how the subject proved who they are. Acting for an unverified requester is itself a data breach.” Record how the person proved their identity (for example a signed-in session or an e-mail challenge) before you build a dossier or erase.
Build a dossier
The dossier is “every module’s rows about one person in one file — the most concentrated personal data this system emits”. It is offered as a short-lived link (Dossier Link Lifetime (seconds)) and kept for a limited time (Keep Dossiers For (days), 30 by default). Send it to the person over a safe channel and do not keep copies.
Run an erasure
- Preview: every module reports what it would delete or anonymise, and what it must keep. Nothing is changed.
- Submit: with Erasure Needs Approval on (recommended), a second person must approve it; your own approval is refused.
- Execute: every module erases its rows. Afterwards each one is asked again and must report nothing left.
| Outcome | Meaning |
|---|---|
| Completed | Everything was erased. |
| Partial | Some rows are kept for a legal reason (for example a bookkeeping period or a legal hold), or a module failed. The request lists what was kept and why. |
| Rejected | A reviewer rejected the erasure, with a note. |
After an erasure the audit log keeps one row (privacy.erasure.executed) with counts and module ids, never the erased data.
What erasure does in Hermetry’s own records
| Record | What happens |
|---|---|
| Audit log | The person’s identity is withdrawn from their rows; the actions stay and the chain still verifies. See Audit log. |
| AI firewall | Incidents about the person lose the actor and close as “The person was erased”; their baseline is deleted. |
| Linked sign-in accounts | Unlinked. |
Settings
Privacy Settings (“Response deadlines, verification and dossier handling for data-subject requests”):
| Setting | Meaning |
|---|---|
| Response Window (days) | The statutory deadline stamped on a new request. “KVKK says 30 days; GDPR says one month.” |
| Require Identity Verification | Blocks dossiers and erasures until verification is recorded. |
| Erasure Needs Approval | A second person confirms each erasure. |
| Data Protection Contact | The address people write to, usually your data protection officer. |
| Dossier Link Lifetime (seconds), Keep Dossiers For (days) | How long a dossier can be fetched and kept. |
| Anonymise Closed Requests After (days) | After this many days a closed request keeps only its kind, status and dates as evidence. |
Retention Policies is a register of how long your organisation keeps each data category and why. It deletes nothing by itself; an erasure that keeps rows can cite it.
Requests people make themselves
Members can export their own data and delete their own account without an administrator. See Export your data and close your organisation.