[Skip to content](https://www.innguma.com/en/resources/faq/permissions/#contenido)

Frequently asked questions

# Who can see each piece of information in Innguma?

**Short answer** 

In Innguma, your organisation decides: people decide what is watched, what is published and who receives it. Access relies on Active Directory, with corporate sign-in and centralised additions and removals, and distribution is carried out through newsletters sent from the Library to the people the team chooses. How each team's access is organised is defined with each organisation during set-up.

## Which security principles apply to access to information?

-   **Least privilege.** NIST defines it as the principle by which each entity receives only the resources and authorisations it needs for its function[\[1\]](https://www.innguma.com/en/resources/faq/permissions/#ref-1).
-   **Role-based access control.** Each user receives one or more roles, and each role carries certain privileges. NIST’s model was adopted as the American standard ANSI/INCITS 359 in 2004 and revised in 2012[\[2\]](https://www.innguma.com/en/resources/faq/permissions/#ref-2).
-   **Need to know.** Belonging to the organisation does not mean being entitled to read every watch.

## What do Spanish and European rules require?

Royal Decree 311/2022, which regulates the National Security Framework (ENS), requires access to systems to be controlled and limited to duly authorised users, processes or systems (Article 17), and systems to be configured granting the minimum privileges necessary (Article 20)[\[3\]](https://www.innguma.com/en/resources/faq/permissions/#ref-3). The General Data Protection Regulation requires data protection by design and by default (Article 25), which includes personal data not being accessible by default to an indeterminate number of people, and appropriate technical and organisational measures for the risk (Article 32)[\[4\]](https://www.innguma.com/en/resources/faq/permissions/#ref-4). The AEPD sets out how to put this into practice in its privacy by design guide[\[5\]](https://www.innguma.com/en/resources/faq/permissions/#ref-5).

## What watch information is sensitive?

More than it seems. A public news item stops being harmless when it is combined with the organisation’s judgement:

-   **What is watched.** A watch on a specific technology reveals an R&D line; a watch on a company may reveal a corporate transaction.
-   **Internal comments.** The assessments the team adds to a signal express its own positions and plans.
-   **Personal data.** The names of executives, researchers or contacts that appear in signals, and recipient lists.

## How is access controlled at each layer of Innguma?

| Layer | Control question | How it is handled in Innguma |
| --- | --- | --- |
| Identity | Who is this person, and are they still in the organisation? | Integration with Active Directory: corporate sign-in and centralised additions and removals |
| Work | Who processes and validates the signals? | Factory, the space where Innguma processes and structures signals, is the analyst’s working environment |
| Distribution | Who receives each piece of content? | Newsletters are sent from the Library to the people the team chooses |
| Connected AI | What can an external assistant do? | Through MCP, compatible with ChatGPT, Claude, Microsoft Copilot and Gemini, the assistant works with the capabilities that Innguma makes available to each integration and that your organisation enables |
| Infrastructure | Are the systems protected? | ENS MEDIUM category for the systems supporting the managed watch services (certificate 34/5704/24/05039, OCA Global, valid until June 2028)[\[6\]](https://www.innguma.com/en/resources/faq/permissions/#ref-6), and data processing in line with the GDPR |

## Questions to settle during set-up

1.  Who needs to work with the information, and who only needs to receive it?
2.  Which watches handle sensitive information, such as own projects, customers or transactions, and who should receive it?
3.  How are additions, removals and changes of area communicated, so that access is adjusted in time?
4.  How often are the recipients of each newsletter reviewed?
5.  Which capabilities are enabled in the integration with an AI assistant, and who reviews what is published?

## Sources and references

1.  \[1\] [NIST, Computer Security Resource Center. Glossary: least privilege](https://csrc.nist.gov/glossary/term/least_privilege)
2.  \[2\] [NIST. Role Based Access Control](https://csrc.nist.gov/projects/role-based-access-control)
3.  \[3\] [Royal Decree 311/2022, of 3 May, regulating Spain's National Security Framework (ENS). Spain's Official State Gazette (BOE)](https://www.boe.es/buscar/act.php?id=BOE-A-2022-7191)
4.  \[4\] [Regulation (EU) 2016/679, General Data Protection Regulation. EUR-Lex, 2016](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
5.  \[5\] [AEPD. Privacy by design guide. October 2019](https://www.aepd.es/guias/guia-privacidad-desde-diseno.pdf)
6.  \[6\] [Innguma ENS certificate (PDF)](https://www.innguma.com/certificados/ens.pdf)

## Related

- [Does Innguma integrate with Active Directory?](https://www.innguma.com/en/resources/faq/active-directory/)
- [What does Innguma's ENS certification cover?](https://www.innguma.com/en/resources/faq/ens/)
- [Can AI connected to Innguma see all the information?](https://www.innguma.com/en/resources/faq/ai-permissions/)
- [Where can I check Innguma's certificates?](https://www.innguma.com/en/resources/faq/verify-certificates/)

- [Request a demo](https://www.innguma.com/en/demo/)
- [Back to the FAQ](https://www.innguma.com/en/resources/faq/#faq-seguridad)