Security & Privacy
Security and privacy by design
SmarterMetric AI is designed so that organizations decide what is collected, who can see it and how long it is kept — and so that those decisions are enforced by the system.
Access control
Access is based on explicit permissions assigned through organizational roles.
- Permission-based roles instead of implicit administrator access
- Access scoped to organization, location, department or team
- Viewing monitoring content requires its own permission
Tenant isolation
Customer data always belongs to exactly one organization.
- Every query is scoped to the active organization
- No silent default organization
- Cross-organization requests are rejected
Device identity and enrollment
Agents authenticate as devices, never with employee or user credentials.
- Short-lived, single-use enrollment tokens stored only as hashes
- Device keys generated and kept in protected storage on the device
- Revocation takes effect on the next request
Policy-based collection
Collection is driven by published policies resolved for each device.
- Nothing is collected without an applicable published policy
- Policy conflicts and expired configurations disable collection
- Privacy exclusions are applied on the device before data is created
Retention
Retention is defined by the policy that authorized the collection.
- Data reaching its retention deadline is physically deleted
- Later policy changes do not silently extend earlier data
- Deletion runs are recorded as aggregate audit entries
Storage and transport
Data in transit uses TLS and binary content is kept in private object storage.
- Screenshots and other binaries are never stored in the database
- Object storage is never exposed publicly to the browser
- Local agent queues are encrypted before upload
A transparent agent
- The agent is visible to authorized administrators
- Authorized administrators can stop and uninstall it
- No stealth techniques, process hiding or security-software bypass
- Screenshot collection is disabled by default
About compliance
SmarterMetric AI provides controls — purposes, policies, notices, retention and access permissions — that help organizations meet their own obligations under KVKK and GDPR. Compliance depends on how each organization configures and uses the product. We do not claim certifications we do not hold.
Related topics
Privacy-first analytics in practice
See how these principles apply to specific use cases.
Ready to understand your workforce better?
Let's look together at how SmarterMetric AI could work for your organization.
Request a Demo