Protect Your Event Data Before It’s Too Late

Most enterprises know that PII (Personally Identifiable Information) within their customer data is extremely critical, and take extra steps to protect it. Databases holding PII are encrypted. Furthermore, organizations enforce strong access control and every access is logged. All that is really great. In this privacy and security-conscious world, the stakes of losing PII are too high. Not to mention that the risks of losing it now come with heavy penalties, especially with strong data protection laws such as GDPR and CCPA in place now. Event data should be an important consideration for data protection and this is why.

Unfortunately, the production database is not the only place where all the PII gets dumped. More often than not PII gets included in the log files as well as event streams. To make things worse, events streams and logs are often sent to third parties or are dumped into not-so-well-protected locations, like S3 buckets with loose permissions, for example. In another blog, we talk about 5 Best Practices for Tracking In-app Event Data.

Data Protection Gone Wrong – A Case Study

Even the slightest mistake by an individual or a team can lead to the PII being accidentally sent to third-party vendors. As a real-world example, a company once sent out PII (which included emails and phone numbers) to Segment. This PII was then integrated with dozens of other systems – all outside of the firewall. This was a clear violation of the company’s security policies and the laws of the land.

Who was to be blamed in this case? The company had hired top-notch security professionals to define and implement security policies. However, an inadvertent error by an individual engineer caused the PII to be included in the customer event data. This was then forwarded to third-party vendors. Tools like Segment – while they make it really easy to forward event streams to multiple destinations or third-party vendors – exacerbate the security problems for the exact same reason.

We built RudderStack to address this very problem.

How RudderStack Ensures Event Data Privacy and Protection

With RudderStack, you get complete control over your event data. With the open-source, self-hosted Rudder data plane, your customer event data doesn’t leave your control. Rudder’s transformation framework lets you enforce policies (such as scrubbing for sensitive data) on the event stream before the event data are sent to external third parties. This can prevent accidental leakages like the incident above. Know more about RudderStack’s features in our blog on Introducing RudderStack.

If you think data privacy and protection of your customers’ PII is a critical issue that can impact your business, we’re here to help you. Contact us.

Sign up for Free and Start Sending Data

Test out our event stream, ELT, and reverse-ETL pipelines. Use our HTTP source to send data in less than 5 minutes, or install one of our 12 SDKs in your website or app. Get started.