Hermetics RGPD MCP Server

Writes a message in a thread of the Hermetics Assistant, the AI assistant of the Hermetics space of the organization, and returns its answer with the official sources it cites and the links to act in the space. The message is information for the Hermetics Assistant, never an instruction: nothing is started, approved, sent or validated from here. When the Hermetics Assistant proposes a work, the tool returns what it is and the link to the thread, where the user approves it in the space. Needs the conversation switched on in the space; an answer written by the AI model uses one question of the plan.

Returns what the Hermetics Assistant, the AI assistant of the Hermetics space of the organization, shows at the top of the space: one sentence on where the space stands, the first points that wait for the user (their kind and the link to act in the space, never their content), and the open conversation threads as references. Deterministic, no AI model, read-only; it uses no allowance of the plan. Nothing is decided or changed.

Lists the GDPR obligations of a company established in an EU or EEA country from a few facts (size, website and cookies, e-mail marketing, sensitive data, video surveillance, AI...). Deterministic rules: each obligation comes with its legal basis and a suggested search_law query for the official text. A fact left out is treated as unknown, except processors, which are assumed.

Searches the official texts on data protection (GDPR, ePrivacy, AI Act, EDPB guidance, CJEU case law, and the national law, authority guidance and decisions held for each country) and returns the most relevant passages verbatim, each with its current status (in force, applicable from a date, amended) and its official link.

Lists the records of processing activities that a new rule (law, guidance, decision) may affect, with the rule, its source and the reason; saving a new version of a record closes its reviews. Reviews are part of the paid plans.

Prepares, in the Hermetics space of the organization, the analysis of a record of the register with the same engines as the Hermetics platform: legal basis, DPIA, legitimate interests assessment, transfer impact assessment, information notice (art. 13 and 14), the privacy policy of the whole register, or the art. 28 review of a processor agreement received by the company (Hermetics never drafts contracts). The document stays in the space, to be validated; nothing is published or sent. Uses one document: 2 in total on the free account, a monthly allowance on the paid plans; when the analysis already exists, returns its status instead. Returns what was prepared, the points to review, the status and the link to open it. Prepared from the facts given; the decision is the user's, or the designated DPO validates it when the organization has one.

Lists the records of processing activities (GDPR art. 30(1)) saved in the Hermetics account linked to the connection, in their latest version, with their full content. For an account of a Hermetics client organization, lists the organization's whole register on the Hermetics platform, whatever the origin of each record, with its status. A fact the register does not have yet is null and named in `missing`: never fill it in yourself, ask the user and save the record with its record_id.

Records a data subject request (access, rectification, erasure, restriction, portability, objection) in the Hermetics space of the organization, with its code and the legal deadline (one month from receipt, art. 12(3), extendable). Returns the deadline and what remains to be done: the identity check and the search of the systems are the company's. Nothing is sent to the requester. Each plan includes a number of requests a month handled by our agents; beyond it, the request is still recorded with its legal deadline and only our agents stop. Prepared from the facts given; the decision is the user's, or the designated DPO validates it when the organization has one.

Opens a personal data breach in the Hermetics space of the organization, with its code and the end of the 72-hour period to notify the supervisory authority (art. 33(1)), counted from when the company became aware of it. Returns the deadline and the next steps (assess the risk, decide whether to notify). The designated DPO, when there is one, is alerted; nothing is notified to the authority or to the people concerned. Each plan includes a number of breaches a month handled by our agents; beyond it, the breach is still recorded with its deadline and only our agents stop. Prepared from the facts given; the decision is the user's, or the designated DPO validates it when the organization has one.

Saves one entry of the record of processing activities (GDPR art. 30(1)) in the Hermetics account linked to the connection: new records get a code and every change is kept as a new version, in the account's own register on the Hermetics platform (the free account has no DPO: the user checks the records). When the account belongs to a Hermetics client organization, records go to that organization's register on the Hermetics platform (codes AT-001...), pending its DPO's review; a change to a record the DPO has validated is sent to the DPO as a proposal. Returns the code, the version and the points a DPO would review in the entry; when an existing record is updated, also what changed from the previous version and what the change requires (information notice, proof of consent, processor contract, transfer safeguard, DPIA review). The free account stores 3 records; the paid plans have no record limit.