Privacy Policy – AssetHermit

Who we are

AssetHermit is provided by Webscale Oy, a company registered in Finland (business ID 2562359-7), Fredrikinkatu 42, 00100 Helsinki, Finland. Write to us about your personal data at privacy@assethermit.com.

AssetHermit may move to a company of its own. That company then takes our place in this policy, and we publish a new version and tell organization owners as described under Changes.

Our two roles

We're the controller of account data: about the people who register, are invited, sign in, pay or write to us, and visitors to this website, and of statistics of how our websites and apps are used.
We're our customers' processor of customer data: what an organization's asset and cost sources collect from its clouds (resource names, tags, configuration, cost lines), and its asset groups, findings, notifications and assistant conversations. That data can hold personal data, such as a name someone put in a tag. The customer is its controller and our Data Processing Addendum governs how we handle it. Requests about it go to the customer's organization, which we help to answer.

What we collect, why, and for how long

Data	From	Why	Legal basis	Kept
Registration: the owner's name and email and its verification, the organization's name and ID, its plan and home region, and when the terms were accepted and which version	The owner	Create the organization and contact its owner	Contract	While the organization exists, then as described under Deletion
Account: email, name, role, workspace access, last sign-in	The person, or an admin who invites them	Sign-in and access control	Contract	Until the person is removed from the organization, or it's deleted
Credentials: a password verifier and a two-step verification secret, held by Amazon Cognito. We never store a password in plain text	The person	Sign-in	Contract	As long as the account
Invitations: the invited email and role	An admin	Invite people	Contract	7 days, or until accepted
Google or Microsoft identity (see the sections below)	The provider, when the person chooses it	Sign-in	Contract	Until an admin resets the person's sign-in, the person is removed, or the organization is deleted
Activity: the organization's audit log (who did what, to what, when)	The service	The customer's audit log, and security	Contract, legitimate interest	180 days
Notifications: inbox state, email deliveries, Slack user links	The service and the person	Deliver alerts and notices	Contract	90 days after a notification resolves
Assistant conversations	The person	Answer questions. Private to the person who asked	Contract	30 days
Support cases: messages, who opened and watches them	The person, our staff	Answer and follow up	Contract	2 years after the case closes
Billing: the name, email and billing details of the owner or the billing contact they give us, the plan, and the invoices we send from our accounting. With Stripe, its customer ID and subscription state. Card details go to Stripe only	The owner, Stripe	Invoice the service, and tax	Contract, legal obligation	As long as accounting law requires
Request logs: the IP address of each request to our servers, when it came and the route it asked for. For a request our firewall refused, challenged or flagged, also its headers, such as the browser's type and language and the site that linked to us, and the firewall rules it met. Never its cookies, credentials, query string or body	The browser or API client	Protect the service: find and stop abuse, and investigate security incidents	Legitimate interest	90 days
Bot check: signals about the browser and how the page was used, such as the browser's type and settings and whether keys were pressed, when someone registers an organization, changes the owner's email or asks for their sign-in links	The browser, through AWS WAF's script on those pages	Keep scripts from registering organizations and from sending our email	Legitimate interest	The check's result, valid for 5 minutes, in the aws-waf-token cookie; the signals by Amazon Web Services as our hosting provider
Visit statistics: the pages and app screens viewed (never their addresses or contents), the site that linked to us, campaign tags, country, browser and device type	The browser, through our request logs	Understand how our websites and apps are used, and improve them	Legitimate interest	The request logs with the IP address 3 days; each day's records under a key that can't be tied back to anyone, 30 days; daily totals, kept
Our staff's actions on organizations (who did what, when), which may name an owner's email	Our staff	Accountability for what our staff do, and security	Legitimate interest	1 year
Email to us	The sender	Answer it	Legitimate interest	As long as we need it to answer and follow up
Error reports: our own IDs, the cloud account ID and a message with personal data removed. Never request data or payloads	The service	Find and fix our faults	Legitimate interest	30 days

We use the IP addresses in request logs to protect the service, and to count unique visitors per day with a key that changes every day and is deleted after 3 days. Never for marketing to anyone, profiling, or tracking anyone across days or sites, and never to locate anyone beyond their country.

Google user data

This section covers what AssetHermit does with data it receives from Google when someone signs in with Google.

What we access. When someone chooses "Continue with Google", we ask Google for theopenid, email and profile scopes and receive an ID token with their Google account ID, email address, whether Google verified it, their Google Workspace domain if they have one, and their name and profile picture. Nothing else: no Gmail, Drive, Calendar or contacts, and never their Google password.
How we use it. Only to sign that person in to their organization, to match them to their invitation or account, and to apply their organization's sign-in rules, such as allowing only its Google Workspace domains. Never for advertising, profiling, selling, credit decisions or training AI models.
What we store. The Google account ID, the email Google gave, and when the link was made and last used, in the organization's own table, encrypted with the organization's key, in its home region. We read the name and picture with the ID token and don't store them. We check Google's tokens and discard them at once: we keep no Google access or refresh token, so we can't call Google's APIs as the person.
Who we share it with. Nobody. Amazon Web Services stores it as our hosting provider. The organization's admins see that a person signs in with Google.
When it's deleted. When an admin resets the person's sign-in, the person is removed from the organization, or the organization is deleted (see Deletion). Anyone can also remove AssetHermit's access in their Google Account settings.
Google's policy. AssetHermit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Our own staff sign in to AssetHermit's administration with their AssetHermit Google accounts, on the same terms.

Microsoft user data

What we access. When someone chooses "Continue with Microsoft", we ask Microsoft Entra ID for theopenid, profile and email scopes and receive an ID token with their tenant ID and object ID, email address, whether their tenant has verified the email's domain, and their name. We refuse personal Microsoft accounts.
How we use it. Only to sign that person in, to match them to their invitation or account, and to apply their organization's sign-in rules.
What we store. The tenant and object IDs, the email Microsoft gave, and when the link was made and last used, as for Google above. When an admin connects their organization's Microsoft tenant, we store the tenant's ID and their email's domain.
Sharing and deletion. As for Google: nobody, and deleted at the same times. We keep no Microsoft access or refresh token.

Cloud data we collect for customers

Customers connect their AWS, Azure and Google Cloud accounts. AssetHermit reads them through access the customer grants and can revoke at any time: roles, federated identities and principal sets, never keys or passwords. It reads only; it never changes anything in a customer's cloud.

What it reads: each resource's configuration as the cloud's API returns it (names, tags, settings) and the rows of the cost exports the customer connects.
Each workspace keeps its data in its own region, encrypted with its own key.
Each sync's files are kept for the workspace's history setting (30, 90 or 180 days, as far as the plan allows; 30 by default, or the plan's longest when that's shorter), and the latest sync is always kept.
A file deleted when its retention passes, or when its asset source or cost source is removed, stays recoverable to us for 7 days, so we can undo a mistake of ours, then is gone.
We store no cloud credentials. The one secret we keep is a workspace's Slack bot token when it connects Slack, encrypted with the workspace's key and revoked when it disconnects.

The AI assistant

The assistant is off until an admin of the organization turns it on.
Questions, and the data its tools read to answer them, go to a model on Amazon Bedrock within the workspace's geography: the EU for a workspace in an EU region, the US for one in a US region.
Amazon Bedrock doesn't store prompts or answers or use them to train models, and the model's maker doesn't receive them. Model invocation logging is turned off across our AWS accounts.
We don't train models on customer data.
Conversations are private to the person who had them, and kept 30 days.

We use a few service providers (subprocessors), each listed with what it receives on the subprocessors page: Amazon Web Services for hosting, Stripe for payments, Google Workspace for our email, Google and Microsoft for sign-in when a person chooses them, and Slack when a workspace connects it.

We never sell personal data. We disclose it to authorities only when the law requires it, and tell the customer when we're allowed to.

Where data is stored, and transfers

An organization's data lives in its home region, which the owner chooses at registration (EU – Stockholm, EU – Ireland or US East – N. Virginia). Each workspace's data lives in the workspace's own region.
Our control plane, which holds each organization's name, its owner's name and email, and its billing state, is in the EU (Stockholm).
Email and Slack messages pass between regions as they're delivered.
Where personal data goes to a company in the US, the transfer relies on the EU–US Data Privacy Framework when the company is certified under it, and on the European Commission's standard contractual clauses otherwise.

Deletion

Removing a person from an organization deletes their account and linked sign-ins. The audit log keeps their email as the person who did what they did, until its retention passes. Elsewhere, such as who reviewed a cost anomaly, they're shown as a former member.
A deleted workspace is kept for 30 days, so it can be restored, then destroyed.
A deleted organization is destroyed at once: its people, sign-ins, workspaces and data. An organization whose subscription lapses is suspended, then deleted 30 days later if it never paid, or 30 days if it did, after emails to its owner.
Each organization's and workspace's encryption key is deleted 30 days after it, and the database's recovery copies end 35 days after it, so nothing left can be read after 30 days.
What we keep after that: the organization's ID, so it's never used again, and the billing records accounting law requires. Its customer record at Stripe stays for those records, named by the organization's ID: we remove the owner's name, email and payment methods from it. The invoices keep the details they were issued with.

Security

Each organization and workspace has its own infrastructure and its own encryption key. Cloud access is read-only and keyless, and everyone signs in with two-step verification or through their Google or Microsoft account. More on the security overview.

Your rights

You can ask to access, correct, delete, restrict or move your personal data, or object to how we use it. Much of this you can do in the app: your profile, your notification settings, and the unsubscribe link in notification emails. For the rest, write to privacy@assethermit.com. We answer within a month.

For data in an organization's clouds, contact that organization: it's the controller, and we help it answer. If you can't sign in, write to support@assethermit.com.

You can complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi), or to the data protection authority where you live or work.

Cookies and local storage

Our websites and apps set no cookies of their own, use no third-party analytics or trackers, and store nothing in your browser for statistics. We count visits ourselves from our own servers' request logs (above). If your browser sends Global Privacy Control, your visits are counted but never as a visitor. The apps keep your sign-in and your light or dark theme in your browser's local storage, which they need to work. The pages that register an organization or send sign-in links run AWS WAF's bot check (above), which keeps its result, valid for5 minutes, in the aws-waf-token cookie. Those forms need it to work, and we use it for nothing else.

Children

AssetHermit is for businesses, not for anyone under 16.

Changes to this policy

Each version of this policy is dated, and earlier versions stay readable below. We email organization owners 30 days before a change that affects how we use their data. A new use of Google user data starts only after the people it concerns have agreed to it.