# Hermetics

> GDPR (RGPD) compliance for companies and their AI agents: the official texts of EU data protection law quoted verbatim with their status, the obligations of a company, and the record of processing activities, from one account reachable three ways (web platform, MCP server, API). Plans without a DPO (agents suggest, the company decides) and with a designated DPO (a human DPO analyses and signs).

## When to use Hermetics

- A question on EU data protection law that needs the official text, its source and whether it is still in force.
- Listing a company's GDPR obligations from a few facts (activity, size, data, countries).
- Writing or updating the record of processing activities (art. 30), or preparing a DPIA, LIA, TIA or information notice from it.
- Tracking the legal deadline of a data subject request or the 72 hours of a personal data breach.
- Not for: drafting contracts, legal advice on a specific dispute, or law outside data protection.

## Get started (self-serve, no sales call)

- Free tier, no card: create an account at https://hermetics.fr/login with an e-mail address and a code
- Self-serve API key: https://hermetics.fr/mcp/cle
- MCP server: https://hermetics.fr/api/mcp, sign-in by OAuth from the assistant; the free account works as a sandbox

## Pages in Markdown

- The home, plans, platform and DPO pages answer `Accept: text/markdown` with Markdown: https://hermetics.fr/index.md, https://hermetics.fr/tarifs.md (also /pricing.md), https://hermetics.fr/plateforme.md, https://hermetics.fr/dpo-designe.md, https://hermetics.fr/en.md, https://hermetics.fr/pt.md

## Connect an AI assistant (MCP)

- Endpoint: https://hermetics.fr/api/mcp (Streamable HTTP)
- Authentication: OAuth 2.1 (discovery per RFC 9728, dynamic client registration, PKCE), signing in with an e-mail address and a code; or an API key sent as `Authorization: Bearer hk_...` (get one at https://hermetics.fr/mcp/cle)
- Tools: `search_law` (official passages with source and status), `gdpr_obligations` (a company's GDPR obligations from a few facts), `save_processing_record` and `list_processing_records` (art. 30 record entries, checked, numbered and versioned; an update returns what changed and what it requires), `pending_reviews` (paid plans: the records a new rule may affect, with the rule and its source), and `prepare_analysis` (legal basis, DPIA, LIA, TIA, information notice, privacy policy or the art. 28 review of a processor agreement received, prepared in the organization's space to be validated), `answer_analysis_questions` (the user's answers to the questions of an open DPIA, LIA or TIA, through the same interview as the space, and the questions that remain; the answers are reviewed and sent in the space), `record_request` (a data subject request with its legal deadline) and `report_breach` (a personal data breach with the end of the 72-hour period); nothing is sent to the requester or to the authority (the free account includes 1 analysis a month (processor contract reviews are part of the paid plans), and our agents handle 1 request and 1 breach a month; beyond that, the request or the breach is still recorded with its legal deadline, only our agents stop); for a client organization, `hermetics_status` (where the space stands and what waits for the user, by rules, without an AI model) and `hermetics_message` (a message to the Hermetics Assistant, the AI assistant of the space, answered with its sources; a work it proposes is approved only in the space)
- Details: https://hermetics.fr/mcp

## Call the API (REST)

- The same tools, one endpoint each: `POST https://hermetics.fr/api/v1/tools/<tool>` with the tool arguments as a JSON object, `Authorization: Bearer hk_...`
- OpenAPI 3.1 specification: https://hermetics.fr/openapi.json
- Errors are JSON: `{"error": {"code", "message", "hint"}}`

## Plans

- Free: 3 activities in the record prepared by our agents, 1 analysis (DPIA, LIA, TIA) per month (processor contract reviews are part of the paid plans), 1 data subject request and 1 incident tracked per month, 100 calls per month (platform and MCP tool calls), 5 questions to our library per month, no card
- Paid plans, each with a number for every limit, everything counted per month except activities and users: 15 or 50 activities in the record, activity revisions, the record reviewed at each change in the law, analyses (DPIA, LIA, TIA) and processor contract reviews, 10 or 30 data subject requests and 5 or 12 incidents per month; beyond the requests and incidents of the plan, the request or the incident is still recorded with its legal deadline, only our agents stop
- Without a DPO (suggestions, unsigned; opening soon): Essentiel 26 EUR, Pro 53 EUR excl. VAT per month
- Custom: beyond 50 activities or four legal entities, a written offer on quote
- Designated DPO (signed): a supplement from +504 EUR per month on any paid plan (from 530 EUR in total with Essentiel), by headcount of each legal entity, the plan's quotas applying; above 1,000 people, a written offer; for companies established in France
- Prices and limits: https://hermetics.fr/tarifs

## Notes

- Information on the law, not legal advice, unless a designated DPO signs it.
- Data hosted and processed in the EU. Do not put personal data in questions.
- Contact: contact@hermetics.fr