Security and privacy
Last updated:
Hirro stores your data in the European Union on Amazon Web Services, signs a standard data processing agreement (DPA) with every customer, and lets you decide what staff phones report. In tag-only mode, a phone reports which tags it hears and nothing about where its owner is. Hirro is working toward ISO 27001 and is not certified yet.
What do staff phones report?
Section titled “What do staff phones report?”| Mode | The phone reports | Use when |
|---|---|---|
| Tag sightings only | Which tags it heard, and when | You track assets and not people |
| Tag sightings and phone location | The tags it heard and the phone’s location | Your policy and works council allow it |
You set the mode per company or per team.
Is it legal under GDPR to track equipment with employees’ phones?
Section titled “Is it legal under GDPR to track equipment with employees’ phones?”It can be, with a clear purpose and the right setup. In tag-only mode, the app reports which tags it hears, not where the person is. Agree the mode with your works council before rollout and record it in the DPA.
Where is the data stored?
Section titled “Where is the data stored?”In the European Union, on Amazon Web Services. This covers your inventory, its history and your account data.
Do you sign a data processing agreement?
Section titled “Do you sign a data processing agreement?”Yes. Every customer signs our standard DPA. Hirro processes the data on your instructions.
Is Hirro ISO 27001 certified?
Section titled “Is Hirro ISO 27001 certified?”Not yet. We are building our information security management to the ISO 27001 standard.
What can an AI assistant see through the MCP server?
Section titled “What can an AI assistant see through the MCP server?”The same assets and sites the signed-in Hirro account can see, and nothing more. See MCP server.