Hermes365

Legal

Privacy Policy

Last updated: 4 November 2026 (version 1)

1. Controller and Scope

The controller for the processing of personal data described in this Privacy Policy is dotCLOUD Consulting (Schweiz) GmbH, Bahnhofstrasse 9, 8952 Schlieren ZH, Switzerland ("dotCLOUD", "we", "us").

This Privacy Policy explains how we process personal data when you visit the Hermes365 websites, use the Hermes365 platform as a customer or partner, or contact us. It is based on the Swiss Federal Act on Data Protection (FADP / DSG) and, where it applies, the EU General Data Protection Regulation (GDPR).

For the email content that Hermes365 migrates on behalf of a customer, the customer is the controller and we act as its processor. That processing is governed by our Data Processing Agreement; sections 4 and 5 of this policy describe how it works technically.

2. Personal Data We Process

  • Account data: name, work email address, Microsoft Entra tenant ID and user object ID of the users who sign in, their roles, invitations and sign-in times.
  • Organisation data: company name and contact details of customers and partners, partner access grants and requests.
  • Microsoft 365 connection data: tenant ID, display name and verified domains of connected Microsoft 365 tenants, the user principal name of the administrator who granted consent, and the result of permission checks.
  • Mailbox data: source and target email addresses, source user names, mailbox sizes and item counts, migration status, progress, error codes and timestamps.
  • Source credentials: passwords of IMAP and POP3 source mailboxes that you enter for a migration (see section 5).
  • Migration metadata: per-folder progress (for example message counts and IMAP UIDs) and non-reversible keyed fingerprints of message identifiers, used solely to avoid duplicate messages when a migration is repeated. They do not allow the content of a message to be restored.
  • Licence and billing data: orders, licence balances, amounts, the Stripe customer and session identifiers, and licence keys or vouchers you redeem (licence keys are stored encrypted).
  • Security and audit data: IP address, browser user agent, session records and an audit log of security-relevant and administrative actions.
  • Contact data: name, company, email address, phone number, message and any screenshots you send through our contact or support forms.
  • Legal acceptance records: which version of these documents was accepted, when and by whom.

3. Purposes and Legal Bases

  • Providing the Service, performing migrations, managing licences and accounts: performance of the contract (Art. 6(1)(b) GDPR).
  • Security of the platform, prevention of misuse, audit logs and error analysis: our legitimate interest in a secure and reliable service (Art. 6(1)(f) GDPR).
  • Billing, accounting and statutory record keeping: legal obligations (Art. 6(1)(c) GDPR).
  • Answering contact and support requests: pre-contractual measures or performance of the contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR).

Under the FADP, we process personal data on the basis of these purposes and in accordance with the principles of lawfulness, good faith, proportionality and purpose limitation. We do not sell personal data and do not use it for advertising. No automated individual decisions within the meaning of Art. 21 FADP or Art. 22 GDPR are made.

4. Email Content: In-Memory Processing

Hermes365 does not store email content, subjects or attachments. The platform is built so that the content of your mailboxes never comes to rest on our infrastructure:

  • The migration worker reads each message from the source over an encrypted connection (TLS), holds it only in the working memory (RAM) of the server, converts it, and writes it directly into the target Exchange Online mailbox through Microsoft Graph over TLS.
  • Email bodies, attachments and subjects are not written to disk, to our database, to backups or to log files. They are held in memory only for as long as the transfer of the message takes, and memory use per mailbox is strictly limited.
  • Logs, checkpoints and reports contain counts, folder positions, error codes and timestamps only, never subjects, sender or recipient addresses of messages, or attachment names.
  • Source mailboxes are opened read-only; Hermes365 does not delete or change messages at the source.
  • After the transfer, the content exists only in your source mailbox and in your Exchange Online tenant, under the control of you and Microsoft.

5. Credentials and Access Tokens

Credentials are used strictly for the migration process and protected as follows.

5.1 Source mailbox passwords (IMAP/POP3)

  • Each password is encrypted immediately on entry with AES-256-GCM, using a separate data key for every password. The encryption is bound to your workspace and mailbox, so an encrypted value cannot be used for any other mailbox.
  • The data keys are protected by customer-specific keys held in Azure Key Vault. These keys never leave Azure Key Vault; the encrypted passwords are kept in our database in Switzerland.
  • A password is decrypted only in memory, only by the migration service and only to sign in to the source mailbox for the migration. It is never shown again, never written to logs and never used for any other purpose.
  • Passwords are deleted automatically when the mailbox is cut over, and at the latest 30 days after they were entered. The keys are rotated daily and permanently destroyed 15 days after they are retired, so that even database backups of deleted passwords can no longer be decrypted.

5.2 Microsoft 365 access

  • We never ask for, receive or store Microsoft 365 passwords of your tenant.
  • Access to your Microsoft 365 tenant is granted by your administrator through Microsoft Entra ID admin consent to the Hermes365 enterprise applications, limited to the permissions documented on the platform.
  • Hermes365 obtains short-lived access tokens from Microsoft for the migration. These tokens are held in memory only and are not stored. A token issued to the consenting administrator during the connection step is used once to verify the administrator role and the tenant, and is then discarded.
  • You can revoke the consent at any time in Microsoft Entra ID.

5.3 Licence keys

Licence keys of external resellers that you redeem are encrypted in the same way as source passwords and are used only to verify the licence with the issuing licensing service.

6. Service Providers (Subprocessors)

We use the following service providers. They process personal data only on our instructions, under data processing agreements in accordance with the FADP and Art. 28 GDPR:

  • Microsoft Azure (Microsoft Ireland Operations Ltd. / Microsoft Corporation): hosting and compute of the platform (Azure App Service), database (Azure SQL) and key management (Azure Key Vault), all located in the Switzerland North region.
  • Microsoft Entra ID and Microsoft Graph (Microsoft): sign-in with your Microsoft 365 work account, admin consent, and the transfer of migrated messages into your Exchange Online tenant.
  • Microsoft 365 / Exchange Online (Microsoft): delivery of system emails (invitations, notifications) and receipt of contact and support messages in our mailboxes.
  • Stripe (Stripe Payments Europe, Ltd., Ireland, and its affiliates): payment processing, tax calculation and invoicing. Payment card data is entered directly with Stripe and is never received or stored by us. Stripe is also an independent controller for certain data under its own privacy policy.

7. International Transfers

The Hermes365 platform, its database and its key management are hosted in Switzerland. Some service providers, in particular Microsoft for identity and Graph services and Stripe for payments, may process data in the European Union, the United States or other countries. We only transfer personal data to countries with an adequate level of data protection as recognised by the Swiss Federal Council or the European Commission, or on the basis of appropriate safeguards such as the EU Standard Contractual Clauses (with the amendments required for Switzerland) or the Swiss-U.S. and EU-U.S. Data Privacy Framework certifications of the providers.

8. Cookies and Similar Technologies

We only use cookies that are technically necessary to operate the platform: a session cookie after sign-in and short-lived cookies that protect the sign-in and the Microsoft 365 connection process. They are restricted to our domain, inaccessible to scripts and transmitted only over encrypted connections. We do not use advertising or tracking cookies.

9. Retention

  • Source mailbox passwords: until the cutover of the mailbox, at the latest 30 days after entry (see section 5.1).
  • Email content: not retained (see section 4).
  • Sign-in requests: up to 10 minutes; session records: up to 30 days after the session has ended.
  • Account, workspace, mailbox and migration metadata: for as long as your workspace exists. Fingerprints for duplicate protection are deleted when the migration of the mailbox is reset or the workspace is deleted.
  • Audit and security logs: for as long as your workspace exists and, after that, as long as required for security, evidence and statutory purposes.
  • Orders and billing records: for the statutory retention period, in Switzerland generally ten years.
  • Contact and support messages: as long as required to handle the request and any follow-up.

When your account is deleted, user data that has to remain linked to the audit history is anonymised.

10. Security Measures

  • Strict separation of customer workspaces, enforced in the database and in the application.
  • Encryption in transit (TLS) for all connections and encryption at rest of the database; additional envelope encryption of credentials with keys in Azure Key Vault.
  • Sign-in exclusively through Microsoft Entra ID; server-side sessions with automatic expiry, stricter limits for administrative accounts.
  • Least-privilege access to Microsoft 365: the granted permissions are verified to be exactly those required, initially and daily.
  • Time-limited, documented and audited support access to workspaces.
  • Audit logging of security-relevant and administrative actions.

11. Your Rights

Subject to the conditions of the applicable law, you have the right to:

  • obtain access to your personal data;
  • have incorrect data rectified;
  • have your data erased or its processing restricted;
  • object to processing based on legitimate interests;
  • receive your data in a common machine-readable format (data portability);
  • withdraw consent with effect for the future, where processing is based on consent;
  • lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, with a supervisory authority in the EU/EEA.

Requests concerning email content migrated on behalf of a customer should be addressed to that customer as the controller; we support our customers in answering them.

12. Changes

We may update this Privacy Policy when our services or the legal requirements change. The current version is published on the platform with its date.

13. Contact

For questions about data protection or to exercise your rights, please contact dotCLOUD Consulting (Schweiz) GmbH, Bahnhofstrasse 9, 8952 Schlieren ZH, Switzerland, through the contact form on our website.