Privacy Policy & Admin Audit Disclosures
Privacy policy for IT administrators using NetSense Orchestrator for real-time infrastructure alerts and remote network management.
1. Overview & Purpose
NetSense Orchestrator is an enterprise mobile application engineered for authorized IT administrators, security operations center (SOC) personnel, and network engineers. In addition to delivering real-time alert notifications, NetSense Orchestrator grants authorized personnel the ability to remotely monitor, manage, reconfigure, and troubleshoot NetSense IT infrastructure, firewalls, switches, access points, and cloud gateways.
This Privacy Policy outlines how NetSense Technologies Inc. ("NetSense", "we", "us") handles administrative data, audit logging, device permissions, and security controls within the NetSense Orchestrator Android application.
2. Administrative Control & Command Audit Trail Logging
Because NetSense Orchestrator enables active configuration changes to corporate IT infrastructure, strict security governance and audit trail logging are enforced.
Command Audit Trails: Every administrative operation executed through the application (such as updating firewall rules, rebooting network nodes, pushing policy changes, or modifying access control lists) is permanently recorded in your enterprise organization's NetSense Orchestrator audit log.
Audit Metadata Logged: Audit logs record the administrator's account ID, timestamp, IP address, target device ID, command payload, and action result. This logging is mandatory for enterprise SOC 2, ISO 27001, and HIPAA compliance verification.
Role-Based Access Control (RBAC): Administrative privileges within the mobile app are dictated by your organization's RBAC matrix. The app only displays management actions authorized for your administrator role profile.
3. Information We Collect
To facilitate secure administrative access and ensure operational accountability, NetSense Orchestrator processes the following categories of data:
| Data Category | Specific Items Collected | Purpose | Storage Location |
|---|---|---|---|
| Admin Identity & Credentials | Admin username, email, SAML/OAuth tokens, mTLS client certificates, Session IDs | Authenticating IT administrators and verifying RBAC authorization | Android Hardware Keystore (Encrypted) |
| Remote Action Logs | Command type, execution timestamp, device target ID, admin IP address | Security audit logging & enterprise compliance record-keeping | Enterprise Orchestrator Server Audit Log |
| API Alert & Telemetry Data | NetSense API Session Token, notification receipt acknowledgments | Streaming real-time system alerts directly to authorized admin devices | NetSense Orchestrator Server API |
| Device & Hardware Telemetry | Android OS version, app build number, local IP, network connection type | Ensuring secure API handshake and detecting unauthorized device access | Ephemeral (Session Memory) |
4. Biometric & Step-Up Authentication Security
NetSense Orchestrator supports Android Biometric Authentication (fingerprint or facial recognition) for Step-Up verification prior to performing critical administrative actions (e.g., node reboots or firewall security policy deletions).
Local Biometric Verification: All biometric verification is handled strictly by the local Android OS via the official BiometricPrompt API. NetSense Orchestrator NEVER sees, collects, transmits, or stores your raw biometric data or fingerprint templates. The app receives only a cryptographic boolean confirmation from Android OS.
5. Android Device Permissions Explained
The application requests permissions necessary for remote management, notifications, and hardware onboarding:
| Permission | Android Identifier | Required / Optional | Purpose |
|---|---|---|---|
| Post Notifications | android.permission.POST_NOTIFICATIONS |
Required | Displays urgent infrastructure alerts and command execution status updates. |
| Biometric Security | android.permission.USE_BIOMETRIC |
Optional | Enables biometric Step-Up authentication for high-risk remote administrative commands. |
| Camera Access | android.permission.CAMERA |
Optional | Scans QR codes on new NetSense hardware appliances for instant zero-touch onboarding. |
| Location (Wi-Fi Scanning) | android.permission.ACCESS_FINE_LOCATION |
Optional | Required by Android OS for Wi-Fi network scanning during local AP/gateway provisioning. Location data is never sent to external servers. |
| Network State | android.permission.ACCESS_NETWORK_STATE |
Required | Verifies secure network path connectivity prior to executing management requests. |
6. How Information Is Used
Information processed by NetSense Orchestrator is utilized to:
- Authenticate IT administrators and enforce Role-Based Access Control (RBAC) restrictions.
- Execute remote management requests on target NetSense enterprise infrastructure nodes.
- Maintain immutable audit trails of all remote administrative changes for SOC 2 and regulatory compliance.
- Deliver urgent infrastructure incident notifications via push messaging.
- Facilitate zero-touch hardware provisioning via QR scanning and Wi-Fi pairing.
7. Security Controls & Regulatory Compliance
NetSense Orchestrator is designed for high-security enterprise environments:
- Mutual TLS (mTLS): Connections enforce mutual certificate authentication between the Android client and the enterprise Orchestrator server.
- Automatic Session Timeout: Inactive admin sessions automatically lock after a configured inactivity period, requiring biometric or PIN re-authentication.
- No Plaintext Credential Storage: Passwords and secrets are never cached; authentication relies on short-lived OAuth2 bearer tokens stored in Android Keystore.
8. Data Sharing & Third-Party Services
Zero Data Sales: We do not sell, share, or monetize administrative data, infrastructure topology details, or user telemetry under any circumstances.
Direct NetSense API Architecture: All management commands, telemetry, and real-time alert streams communicate directly over encrypted TLS APIs with your organization's designated enterprise NetSense Orchestrator server environment. No third-party notification brokers, analytics platforms, or cloud messaging services (such as Firebase) are used.
9. Data Retention & User Rights
Client-side app session credentials are removed when the administrator signs out or uninstalls the app. Server-side command audit logs are retained in accordance with your organization's enterprise compliance retention policies (typically 1 to 7 years for SOC 2 compliance).
Administrative users seeking log exports or account access adjustments should contact their organization's Lead Systems Administrator or Chief Information Security Officer (CISO).
10. Contact Information & Policy Updates
We may update this Privacy Policy to reflect app enhancements or evolving compliance standards.
NetSense Technologies Inc. - Enterprise Security Office
Email: privacy@netsense.io
Website: https://netsense.io/privacy