Privacy policy

This policy describes how Hermiscale collects, uses, and protects information in connection with the Hermiscale website (hermiscale.com), the Hermiscale client portal (portal.hermiscale.com), and the monitoring services we provide to our customers.

Hermiscale is operated by Hermiscale LLC (contact details below). References to "we," "us," and "our" in this policy mean Hermiscale LLC.

Information we collect

From website visitors

When you submit the contact or demo-request form on hermiscale.com, we collect the details you provide — typically name, company, email, facility location, approximate device counts, and your message. We also receive standard web request information (IP address, user agent, timestamp) from our infrastructure provider for security and abuse prevention.

From portal users

When a user is invited to the Hermiscale client portal, we collect the email address and name provided during invitation, a hashed representation of their password, and an encrypted secret used for multi-factor authentication. We also log sign-in events, invitation and role changes, and administrative actions for audit purposes (actor, action, timestamp, source IP).

From monitored environments

As a monitoring service, Hermiscale collects operational signals from the infrastructure a customer agrees to monitor. The specific scope is agreed with each customer and documented in their service record. Typical signals include device identifiers (hostnames, IP addresses, serial numbers where exposed by the device), interface state, capacity and utilization metrics, system events, and — for supported remote-access tools — session metadata such as the account used, the public IP of the client, start/end times, and session outcome.

Hermiscale does not read file contents, credentials, or application data on monitored systems. Our collector is read-only toward customer infrastructure and does not change configuration without a documented request.

How we use information

• To respond to your inquiries and schedule demos.
• To provide, operate, and maintain the services our customers have engaged.
• To secure the service — detecting abuse, blocking brute-force attempts, and investigating incidents.
• To communicate operationally with authorized users (service notices, invitation emails, incident updates).
• To comply with legal obligations and enforce our agreements.

We do not sell personal information. We do not use customer data to train machine-learning models offered to parties outside the customer that provided it.

Who we share information with

We share information only with service providers that help us run the service, each of which is bound to use it only for that purpose:

• Cloudflare — hosting, DNS, edge security, and the tunnel between the Hermiscale service and customer sites.
• Resend — transactional email delivery (invites, demo-request replies, service notices).
• Our hosting server (zbx-central-01) — the operating environment for monitoring collection and the backing databases, administered by Hermiscale.

If we add or change a subprocessor in a way that affects customer data, we will note the change in this policy and, where appropriate, notify affected customers.

We may disclose information if required by law, legal process, or to protect the safety or rights of our customers, their users, or the public.

Data retention

Different categories of data are retained for different periods:

• Contact-form submissions: retained for up to 24 months, then deleted or anonymized unless there's an active engagement.
• Portal account data: retained for as long as the account is active plus a reasonable period for audit and legal purposes after termination.
• Audit logs: retained for 12 months by default; longer windows are agreed per customer when needed.
• Monitoring data and remote-access session records: retention is set per customer in their service agreement. Default is 90 days of online retention with longer-term archival available on request.

Security

We take reasonable administrative, technical, and physical measures to protect information:

• Encrypted transport (TLS) for all traffic between customer sites and our hosted service, between the portal and our thin API, and between our users and the portal.
• Multi-factor authentication is required for every portal account.
• Per-customer credentials and scope so one customer cannot access another's data.
• Read-only credentials toward monitored systems.
• Audit logging for sign-in, administrative actions, and data exports.
• Secrets stored in managed secret-storage, not in source code.

No system is perfectly secure. If you believe a security issue affects Hermiscale, please contact us immediately using the details below.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information Hermiscale holds about you, and to object to or restrict certain processing. Portal users can see and update their account information from the Account page in the portal. For other requests, contact us using the details below and we will respond within a reasonable period.

For data that Hermiscale processes on behalf of a customer (for example, monitoring records about devices and users at a customer facility), please direct requests to the Hermiscale customer that controls the relevant service record; Hermiscale will assist that customer as processor.

International transfers

Hermiscale and its service providers are located in the United States. If you access the services from outside the United States, information may be processed in the United States. Where applicable, we rely on standard safeguards (including standard contractual clauses) with our service providers.

Children

Hermiscale is a business-to-business service and is not directed at children. We do not knowingly collect information from children under 16.

Changes

We will update this policy when the service changes or the law requires us to. When we make a material change, we will update the effective date above and, for existing customers, notify a contact of record. Prior versions are kept on file.

Contact

Questions, requests, or concerns about this policy or how your information is handled can be sent to [email protected] or submitted via the contact form.