# Security and privacy

> Hirro stores data in the EU on AWS, signs a standard DPA with every customer, and lets you choose what staff phones report.

Last updated: 2026-11-02

Hirro stores your data in the European Union on Amazon Web Services, signs a standard data processing agreement (DPA) with every customer, and lets you decide what staff phones report. In tag-only mode, a phone reports which tags it hears and nothing about where its owner is. Hirro is working toward ISO 27001 and is not certified yet.

## What do staff phones report?

| Mode | The phone reports | Use when |
|---|---|---|
| Tag sightings only | Which tags it heard, and when | You track assets and not people |
| Tag sightings and phone location | The tags it heard and the phone's location | Your policy and works council allow it |

You set the mode per company or per team.

## Is it legal under GDPR to track equipment with employees' phones?

It can be, with a clear purpose and the right setup. In tag-only mode, the app reports which tags it hears, not where the person is. Agree the mode with your works council before rollout and record it in the DPA.

## Where is the data stored?

In the European Union, on Amazon Web Services. This covers your inventory, its history and your account data.

## Do you sign a data processing agreement?

Yes. Every customer signs our standard DPA. Hirro processes the data on your instructions.

## Is Hirro ISO 27001 certified?

Not yet. We are building our information security management to the ISO 27001 standard.

## What can an AI assistant see through the MCP server?

The same assets and sites the signed-in Hirro account can see, and nothing more. See [MCP server](/integrations/mcp-server/).