SageWM IT-AM · Privacy

Privacy Policy

Version 2 · last updated 2026-09-09 · provided by HDPulseAI · system identifier SageIT_AM

What this product is

SageWM IT-AM is AI-native IT Asset Management for enterprises, provided by HDPulseAI. It inventories hardware, software, SaaS, cloud, and contract assets and governs reclamation. It is not a healthcare application and does not collect or process protected health information (PHI). No HIPAA or BAA obligation applies.

Data we process

Asset metadata (asset tags, names, locations, ownership), business contact data for asset owners and requesters (work email), usage signals (login and activity timestamps), and contract/SaaS entitlement data. The dev and preview environments are populated with synthetic sample data only — no real or realistic SSN, DOB, MRN, or NPI appears anywhere in fixtures, seeds, or exports.

Tenant scoping and access

All data is tenant-scoped. Every query, route, and AI tool resolves through tenant context, and cross-tenant access is denied at the server and again at the database (row-level security on every tenant table). Administrative access to tenant data is audited.

AI activity

Model calls run backend-only through the app's AI gateway; model keys are never held in the browser. Prompts and traces are referenced by SHA-256 hash — no PHI, secrets, or unnecessary personal data is stored in prompts, traces, or logs. AI prepares recommendations; a human approves every system-of-record change at the value boundary. An AI activity log records purpose, model, mode, and latency (metadata only). AI-generated answers are marked as such in the response.

Usage analytics and what your browser stores

With your consent (Settings → Usage analytics, off by default), the service records how guided tours, the role home and your first task went — counts, timings and screen names only, never record content. Help that opens after repeated errors and the state of cards you dismiss are kept regardless, because the product needs them to work. Nothing is sent to a third party: there is no analytics processor, no session replay and no third-party tag. Raw events are anonymised after 395 days, a legal hold pauses that clock, closing a tenant deletes its events, and aggregates are published only for groups of five or more people. Your browser stores only the settings you chose (theme, density, language, navigation state, completed tours, your own recent commands and your offline scan queue). The full register of events, purposes, lawful bases and retention is published with the product as docs/legal/PRIVACY-REGISTER.md.

Security

Passwords are hashed with a slow key-derivation function and never stored in plaintext. Authentication cookies are httpOnly, Secure, and SameSite. Transport uses TLS. Secrets live in the environment or a secret store, never in client bundles or code.

Retention and your choices

Retention is configured by your tenant administrator and audited. Exported asset registers contain business asset data only — no PHI columns. For access, correction, or deletion requests in this deployment, contact your tenant administrator.

Document history

Version 2 (2026-09-09) names the product by its display wordmark and adds the usage-analytics section; the contracting party and every commitment of version 1 (2026-07-01) are unchanged.