What we collect from your environment
- Configuration and inventory metadata from connected clouds, directories, endpoint managers and network devices: resource names, settings, relationships and tags.
- Identity metadata: user and service identities, group membership, roles, MFA registration and last activity. We do not collect passwords; Active Directory sign-in binds as the user and never stores the password.
- Cost data from cloud billing APIs.
- Service desk content that your users enter in ITOps360, including requests such as asking to join a group, and the messages employees send to the ITOps360 assistant in Microsoft Teams or Slack (only one-to-one chats with the assistant; the audit trail records what was done, not the message text).
- Computer inventory from the ITOps360 agent, site collectors and Intune: computer name, hardware model and serial number, operating system and update status, disk, memory and battery health, security status (antivirus, firewall, encryption), installed application names, the signed-in user’s account name, and the names of backup products found, and how many signed-in users have Desktop and Documents in OneDrive or on a file server (counts, not folder paths).
- Network inventory from site collectors: IP and MAC addresses, open ports, device names, and switch and router data read over SNMP.
- Sign-in sightings for suggesting device owners: which account was signed in to a computer and when, kept for up to 30 days.
- AI usage and cost metadata from the AI providers you connect to AgentVision360: daily cost and token counts by project, model and key; API key names, owners, creation and last-use dates (only a masked hint, never the full key); and AI seat holders’ names, e-mail addresses and last activity. AgentVision360 never receives prompt or response content.
- Website and certificate check results for the addresses you choose to monitor: availability, response time, status code and certificate expiry.
We do not read the contents of your storage accounts, databases, mailboxes or files, except what you choose to back up with BackupVision360 or ITOps360 native backup, which is encrypted before it is written to storage. The agent and site collectors read where users’ folders are located to report backup status, never what is in them.
Where it is stored
- In the region you choose for SaaS tenants, or entirely in your environment for private deployments.
- In PostgreSQL with row-level security per tenant. Credentials and secrets are encrypted with tenant-bound keys.
How long we keep it
- Inventory and findings are replaced on each scan; history (changes, resolved findings, score trends) is kept according to your tenant’s retention settings.
- AgentVision360 keeps daily AI spend for 400 days by default (a tenant setting); removing a provider connection deletes its data.
- A computer that is wiped is removed from the device list; its asset record stays so you keep the history.
- Audit records are kept for the life of the tenant unless your contract specifies otherwise.
- Backups are encrypted and rotated on a fixed schedule.
Deletion
When a tenant is closed, its data is deleted from the primary database, and from backups as they rotate out. Customers can request confirmation of deletion.
AI and your data
- AI is optional and controlled per tenant.
- In our hosted service, customer data is never sent to an external AI provider. AI features use only self-hosted models; until one is available they are off and the products give their standard answers.
- Secrets are masked before a prompt reaches any model.
- Prompt and answer text is not stored in audit logs by default; a hash and token counts are.
Your rights
To exercise data protection rights or ask about our processing, e-mail the privacy contact on the contact page.