Security and privacy

FAQ: Many clients ask some basic Security/Privacy related questions. These are the most commonly asked questions and the answers.

● Is client data encrypted? How?

○ Yes, sensitive information is encrypted in-transit by using TLS 1.2-based encryption and at-rest using Microsoft SQL Server Transparent Data Encryption.

● Where is client data housed?

○ We do not store any critical data in-house; client data is processed and hosted with Microsoft Azure.

● Where are data centers located (geolocation)?

○ Azure’s primary facility for PI data is located in the Eastern US, and the backup facility is in the Western US. All data centers and sub-processors are U.S.-based.

● What are your data backup procedures?

○ PI is subscribed to Microsoft Azure premium backup service, which performs full backup weekly; differential backup of all client’s critical data nightly; and transactional log backup every five minutes. All are conducted by Azure managed services and verified by Microsoft in an automated fashion after every backup. Manual verification is tested by the engineering team every two weeks; the backup data is stored in a secure location isolated from the web apps data.

● Who has access to client data?

○ Access to client data is highly restricted. In terms of Client access, the client administrator account is responsible for the creation/deletion of users and assigning access rights. At PI, only engineers have access to the client's data, since they work on the infrastructure and software source code development. Additionally, the User Operations team maintains access for troubleshooting and customer support purposes. This is considered the minimum necessary staff to properly support the product.

● What is PI’s data retention policy?

○ Client data is anonymized automatically 120 days after contract termination, or earlier at the client's request. While under contract, the client can delete/anonymize the data directly through their administrative panel