GDPR & RMM: supervising your IT estate while staying compliant

An RMM collects CPU, RAM, logs, software inventory and sometimes user sessions. Some of this data falls under GDPR — and the IT provider is often joint controller with the client. Here is what to check before deployment.

Personal data in an RMM

• Device hostnames (sometimes containing user names)
• User session names and login times
• IP addresses
• Installed software inventory
• Event logs that may reference identified users
• Remote terminal command history

Hosting location: critical

Prefer an RMM whose entire infrastructure (application, database, backups) is hosted in the European Economic Area. US vendors often rely on AWS regions in Ireland or Germany but remain subject to the US CLOUD Act, which allows access requests from US authorities.

WezOps is hosted entirely in Belgium, outside any US extraterritorial access.

Encryption and secrets

• Agent ↔ server traffic: HTTPS/TLS 1.2+
• Agent authentication tokens: JWT signed Ed25519
• Operator passwords: argon2 or bcrypt
• Database at rest: PostgreSQL + volume encryption

Data Processing Agreement (DPA)

Any RMM vendor must offer a DPA. Make sure the DPA lists sub-processors (hosting providers, email providers, support ticketing), their location, and the ability to object.

Retention policies

Define a retention policy for metrics, logs and audit trails. WezOps keeps 90 days of raw metrics (TimescaleDB) then aggregates them, and lets admins purge audit logs after a configurable period.

User access and audit

GDPR requires traceability. An RMM must offer per-user audit logs (who connected, who ran what command on which device) and role-based access control (admin, technician, read-only).

Checklist for a GDPR-compliant RMM

• Hosting entirely in the EEA
• DPA available on request, listing sub-processors
• TLS 1.2+ encryption everywhere
• Audit logs per user and per device
• Configurable retention policies
• Device erasure on uninstallation
• Two-factor authentication available for operators

WezOps checks all of these boxes natively. Create your free account to see our DPA and privacy policy.