Legal

Privacy policy

Last updated August 5, 2026

PermitUSB has two halves: a Windows agent your IT team installs on company endpoints, and a cloud dashboard. This explains what we collect, why, where it goes, how long we keep it, and how to get it deleted. It is written to be read, not skimmed past.

1. Who this policy covers

Subscribers: The company that creates an account, pays for the service, and installs the agent on its endpoints. The Subscriber decides what to monitor and is the data controller of endpoint and employee data.
Admin users: The individual people, usually IT staff, who sign in to the dashboard under a Subscriber account.
Endpoint Users: The Subscriber’s employees whose Windows machines run the agent. We have no direct relationship with them and process data about them on the Subscriber’s behalf, as a processor. See section 11.

This policy covers the website, the dashboard, the API and the endpoint agent.

2. Information you provide directly

Account data: Your email address, a password and your company name. Passwords are handled by our authentication provider and stored only as a cryptographic hash; we never see or store plaintext passwords. We also store each admin user’s role and MFA status.
Teammate invitations: When you invite a teammate we collect and store the invitee’s email address.
Billing data: Payments are processed by Stripe, which collects your company name, billing contact, billing address and payment instrument. Card numbers never touch our servers: we store only Stripe identifiers and your subscription status.
Content you enter in the dashboard: Policy names, rule definitions, group names, device nicknames and webhook URLs are stored as entered. Free-text fields may contain personal information if you choose to include it. What you type is what we store.
Support email: If you email us, we keep the correspondence.

3. Information the endpoint agent collects

The agent exists to enforce your USB policy and report what happened. Everything below comes from endpoints the Subscriber enrolled, is visible to that Subscriber’s admins, and exists so the product can function.

Enrollment data: Hostname, Windows edition and build, agent version, and two hardware fingerprints used to recognize re-enrollment of the same machine. Both are SHA-256 hashes computed on the endpoint, one of the Windows MachineGuid and one of the SMBIOS system UUID. The raw identifiers never leave the machine.
Check-in data: Roughly every ten minutes the agent reports hostname, OS version, agent version and the Windows account name of the currently signed-in user.
Device events: For each plug, unplug or policy decision: VID and PID, device class, friendly name, and serial number when the device exposes one; the action taken and the rule that matched; the Windows account name of the signed-in user, blank if the machine was at the login screen; the endpoint’s local IP addresses; a timestamp; and the full Windows Plug and Play property record for the device, which includes hardware identifier strings and the computer name.
Server-captured IP: When the agent reports events, our servers record the public IP the report arrived from.
Kernel crash fingerprints: If a Windows crash implicates the PermitUSB driver, the agent reports a fingerprint only: the stop code and its four parameters, the faulting module name and offset, the driver version, the crash time and the dump file name. It reads only the dump’s fixed-size header. Memory contents never leave the machine.
Tamper and health signals: Self-protection signals such as event flooding or rate-limit trips, with minimal accompanying detail.
Local offline buffer: While an endpoint is offline, events are spooled in a local database and uploaded when connectivity returns. The uninstaller can purge this local data.

4. What the agent never collects

These exclusions are design decisions, not marketing.

File contents. PermitUSB sees that a storage device was plugged in, never what is on it. We do not scan, copy, index or inspect files anywhere
Keystrokes, screen contents, microphone, camera or location
Network traffic or browsing activity. We do not proxy or inspect anything
Windows security identifiers, or the machine’s raw hardware identifiers. Only the on-device hashes described above are transmitted
Crash dump memory contents. Fingerprint header only

5. Information collected on the website and dashboard

Authentication cookies: Signing in sets session cookies from our authentication provider and, after multi-factor verification, a first-party MFA cookie. Both are functional cookies required to keep you signed in and are not used for tracking.
Browser storage: Your light or dark theme preference in localStorage and a dismissed-banner flag in sessionStorage. Nothing else.
No analytics or advertising: We run no product analytics, no advertising trackers and no third-party analytics scripts on the website or the dashboard. The marketing site has no lead capture: contact happens over plain email.
Error monitoring: We use Sentry to capture application errors, configured not to collect request headers, cookies or IP addresses, with session replay disabled. Reports are tagged with an internal user ID and tenant ID only, not your email.
Security and infrastructure logs: Our hosting provider keeps standard request logs. We temporarily store client IPs for rate limiting on the unauthenticated agent enrollment endpoints, and our authentication provider records sign-in history including IPs in its own audit trail.
Admin audit log: Administrative actions are recorded in a per-tenant audit log visible to the Subscriber’s admins. When an admin account is deleted, the log retains a record of the deletion including that account’s email address, so the trail stays accountable.

6. How we use information

Provide the service: enforce your policies, show device events and endpoint state to your admins, and deliver the alerts you configure
Protect the service: authentication, rate limiting, tamper detection and driver crash health monitoring
Bill you, through Stripe
Support you when you ask for help
Send transactional and service email to admin contacts: alerts they configured, billing notices, and product or security notices relevant to their account

Sub-processors: A small number of US infrastructure vendors for database and authentication, payments, hosting, transactional email, DNS and error monitoring. The current list, with what each one sees, is on the Sub-processors page.
At your direction: Subscribers can configure outbound webhooks, run the on-premises SIEM relay against their own API key, and export events. Data sent to destinations you configure is governed by those destinations’ terms, and choosing them is your responsibility.
Legal requirements: We may disclose information if required by law, subpoena or other legal process, or to protect the rights, safety or property of JJMK, our customers or the public. Where lawful, we will notify the affected Subscriber before disclosing.
Business transfers: In a merger, acquisition or asset sale, customer data may transfer as part of that transaction, subject to this policy or a successor policy with equivalent protections.

8. Where data lives

PermitUSB is a US-hosted service. Application data is stored in the United States and all of our sub-processors are US-based. We do not currently offer an EU or UK data residency option. If you are subject to GDPR or UK GDPR, you act as controller and engage us as a processor. Contact us with any questions about processing terms before subscribing.

9. Retention and deletion

What	How long
Device events, tamper events and audit logs	365 days from capture, then deleted on a rolling basis. We deliberately do not offer retention shorter than 90 days, because that breaks the compliance use cases our customers rely on. Contact support to discuss a window between 90 and 365 days.
Webhook delivery logs	7 days.
Expired trials	If a trial ends and never converts, the entire tenant and all its data are deleted 30 days after expiry.
Account closure	Data is preserved for 30 days so you can come back, then deleted.
Deletion on request	A Subscriber can request deletion at any time. We delete within 30 days and email confirmation when it completes.
On the endpoint	Uninstalling the agent stops all collection. Uninstalling with the purge option also wipes the local event buffer from the machine.

10. Security

All traffic between the agent, the dashboard and our servers uses TLS 1.2 or higher
Data is encrypted at rest by our database provider
Every customer’s data is isolated per tenant, enforced at the database layer with row-level security
Passwords are hashed by our authentication provider. Agent credentials, enrollment tokens and API keys are stored only as cryptographic hashes
Multi-factor authentication is available to every admin and can be enforced workspace-wide
Agent binaries are signed with an EV code signing certificate, and kernel components are signed through the Microsoft hardware program

No security program is perfect. If you believe you have found a vulnerability, email security@permitusb.com.

11. Notice to Endpoint Users

If your work computer runs the PermitUSB agent, your employer, or the organization that manages your machine, chose to install it and controls what it does. In plain terms:

It records USB device activity on your machine: what device was plugged in or removed, whether it was allowed or blocked, your Windows account name at the time, and the machine’s name and network addresses
It cannot see your files, what you type, your screen, your browsing or your location
We process this data on your employer’s behalf and never contact you or send you marketing
Questions about why it is installed, and any requests to access or delete data about you, should go to your employer, because they control the data

12. Government contractors and CUI

Many customers use PermitUSB while preparing for CMMC or implementing NIST 800-171. Because the agent does not access file contents, Controlled Unclassified Information is not intended to transit or be stored in PermitUSB. What we hold is CUI-adjacent metadata, meaning device events and audit logs, processed on the Subscriber’s behalf. We do not hold a FedRAMP or DoD authorization and do not claim CMMC certification. The control-by-control mapping is published in the documentation.

13. US state privacy rights

PermitUSB is a business-to-business service and we act primarily as a processor, or service provider under the CCPA, for our Subscribers. We do not sell personal information and do not share it for cross-context behavioral advertising. Where a state privacy law grants you rights over personal information we hold as a controller, such as your admin account data, you can exercise them by emailing privacy@permitusb.com. We do not discriminate against anyone for exercising privacy rights. Requests about endpoint data collected on behalf of a Subscriber should go to that Subscriber; we will refer such requests to them and support their response.

14. Children

PermitUSB is a workplace tool for businesses. It is not directed at children and we do not knowingly collect personal information from anyone under 16.

15. Changes to this policy

When we change this policy we post the new version here and update the last-updated date. For material changes we also email Subscriber admin contacts before the change takes effect.