← Back to HERMES

HERMES Dashboard — Privacy Policy

The HERMES Dashboard ("HERMES", "the app", "we") is a research tool that visualizes network-anomaly detections computed over publicly available M-Lab measurement data in Google BigQuery. This policy explains what data the app accesses when you sign in with Google, how it is used, and how to revoke access.

Data we access via Google Sign-In

When you choose to sign in, Google asks for your consent to share the following with HERMES:

• Your email address and basic profile identity (openid, email) — used only to show who is signed in and to label your session in the interface.
• Permission to run BigQuery jobs on your behalf (https://www.googleapis.com/auth/bigquery) — used to execute the data queries that power the per-event drilldown views. Queries run as you against the shared M-Lab BigQuery project, so they are billed to and constrained by your own M-Lab quota. HERMES cannot access any Google data beyond running these BigQuery queries.

How we use it

• To authenticate you and display your signed-in email in the header.
• To submit BigQuery queries against public M-Lab datasets on your behalf and render the results (paths, distributions, topology) back to you in the browser.
• Access to query data is governed entirely by your existing M-Lab group membership; HERMES does not grant, expand, or store any additional data-access rights.

What we store

HERMES stores the minimum needed to operate and to account for query costs. The complete set of data retained on our servers is:

• A query-usage ledger — one row per BigQuery job containing the signed-in user's email address, a UTC timestamp, and the number of bytes the query billed. This exists so each user's own consumption can be shown back to them and so abuse can be detected.
• Standard technical logs — web-server access logs (IP address, timestamp, requested path, response status) and application error logs, used only for debugging, rate limiting, and abuse prevention.

Query results are processed only in memory to render the visualization you requested, and are never written to disk, to a database, or to a log file. We do not build user profiles or advertising identifiers, we do not sell, rent, or trade personal information, and we do not use any data obtained through Google APIs to develop, improve, or train generalized artificial-intelligence or machine-learning models. Data obtained through Google API scopes is never transferred to third parties except as required by law.

How we use Google user data

Google user data is used solely to authenticate you and to execute the BigQuery queries you request. It is not used for any other or unrelated purpose.

How we protect your data

The sensitive Google user data handled by HERMES includes your Google account information (email address), the OAuth credentials used to authorize BigQuery requests on your behalf, the BigQuery query results returned to your browser, and the query metadata (email address, timestamp, and billed bytes) recorded in the usage ledger. OAuth credentials are never stored, and query results are processed only in memory to generate the requested visualization and are never written to disk, to databases, or to log files. We apply the following safeguards:

• Encryption in transit. The application is served exclusively over HTTPS with TLS 1.2 or higher; plain HTTP requests are redirected to HTTPS and HSTS is enabled. Access tokens are transmitted only inside TLS-protected requests, in the Authorization header — never in URLs, query strings, or referrers. All server-to-Google calls (BigQuery, token introspection) likewise use TLS.
• Encryption at rest. Server storage is Google Cloud Platform persistent disk, encrypted at rest by default with AES-256 using Google-managed keys. This covers the usage ledger and all logs.
• Tokens are never persisted. Your OAuth access token is held only in your browser's memory for the duration of your session and in server process memory for the life of the request; it is never written to disk, to a database, or to a log file. HERMES requests no refresh token and no offline access, so all authorization expires automatically (typically within one hour) and cannot be replayed later. A short in-memory cache maps a live token to your email address for at most one hour, purely to avoid repeating an identity lookup on every query; it is discarded when the token expires or the service restarts.
• Least-privilege scopes. HERMES requests only openid, email, and bigquery — the minimum required for sign-in and to run queries on your own quota. It requests no Gmail, Drive, Calendar, Contacts, or other Workspace scopes, and it cannot read any Google data outside BigQuery.
• Access control on our side. The service runs as a dedicated unprivileged system account on a single hardened Google Cloud VM with no public database ports; the usage ledger is a local file readable only on that host. Administrative access is restricted to the named research maintainers of the project through Google Cloud IAM and key-based SSH — there are no shared accounts or shared passwords, and access is reviewed when project membership changes. The host receives operating-system security updates, and application traffic is rate-limited per client to limit abuse.
• Separation of duties. Your token is used for one purpose only: to submit your BigQuery job. It is not reused for background jobs, not shared between users, and not available to any other component of the system. Which data you may query is enforced by Google Cloud IAM and your existing M-Lab group membership, not by HERMES.
• No backups hold your credentials. No backups containing OAuth tokens are created, because OAuth tokens are never stored. The usage ledger and the application logs are not replicated to any separate backup system, and they inherit the retention limits described below.

These protections apply to all Google user data and associated metadata retained by HERMES, including the usage ledger and the application logs that may contain personal information.

Retention and deletion

• Usage-ledger rows are retained for no more than 90 days and then deleted.
• Web-server and application logs are retained for no more than 30 days and then rotated out and deleted.
• OAuth tokens have no retention: they are never stored (see above).
• You may request deletion of all records associated with your email address at any time by writing to [email protected]; we will action such requests within 30 days. Revoking HERMES's access in your Google Account immediately stops any further data being collected.

Security incidents

If we become aware of a breach affecting personal data obtained through Google APIs, we will investigate immediately, revoke the affected credentials, and notify affected users and Google without undue delay and in any case within 72 hours of becoming aware. Suspected vulnerabilities can be reported to [email protected].

Sharing, transfer, and disclosure of Google user data

HERMES does not share, sell, rent, trade, or otherwise transfer Google user data to any third party. There is no advertising network, no analytics vendor, no data broker, and no other external recipient in this application. Google user data is never transferred for any purpose other than providing the app's functionality to you. The only exceptions, both inherent to how the app works, are:

• Google itself. HERMES runs your queries inside Google Cloud Platform / Google BigQuery, so your request necessarily reaches Google in order to be executed. Your use of Google services is also governed by Google's Privacy Policy.
• Legal compulsion. We may disclose data if required to do so by law or valid legal process. We have received no such request to date.

The underlying measurement data that HERMES visualizes is public data collected and published by M-Lab under its own privacy policy; it is not derived from your Google account.

Revoking access

You can revoke HERMES's access to your Google account at any time from Google Account → Third-party access, or by clicking Sign out in the app. Revoking access does not affect data already displayed in your current session.

Google API Services User Data Policy

HERMES's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

If we change how HERMES accesses, uses, stores, or shares Google user data, we will update this page and revise the "Last updated" date above before the change takes effect. For any material change — a new scope, a new category of data, a new recipient, or a longer retention period — we will additionally notify signed-in users through a notice in the app interface, and where the change requires it, request your consent again through Google. Continued use of HERMES after such a notice indicates acceptance of the updated policy.

Contact

HERMES is a research tool built and operated by Loqman Salamatian at Columbia University in collaboration with M-Lab. Questions about this policy, requests for deletion, or any other privacy matter can be directed to [email protected].