You’ve probably heard all about the EU’s new regulation, the General Data Protection Regulation (GDPR). The GDPR applies not only to EU-based businesses but also to any business that controls or processes data of EU citizens. Not only is GDPR an important step in protecting privacy for European citizens, it also raises the bar for data protection, security, and compliance in the industry.
At Keen, we’ve been hard at work to ensure that our own practices are GDPR-compliant. A big piece of that is ensuring that our product makes it easy for you to use Keen to handle data in compliance with GDPR requirements. In March 2018 we published a blog post that detailed the steps we would take in order to accomplish this.
Since that time, we’ve accomplished the following:
- Appointed a Data Protection Officer and a data protection working team
- Built a formal data map
- Performed internal threat modeling and gap analysis (and set up a recurring schedule)
- Adopted and formalized written policies around core areas, including (but not necessarily limited to): data protection, data backup, data retention, access management, and breach management and reporting
- Conducted formal data protection training for all Keen employees
- Encrypted data at rest (still in progress for some data)
- We’re working with a 3rd party auditor to schedule annual security audits
- Completed legal paperwork to confirm that our Data Sub-processors (primarily Amazon) are GDPR-compliant
- Offer a Data Processor Agreement to our customers upon request
- Received Privacy Shield certification
There are several additional security enhancements that we will continue to iterate on and improve over time:
- More granular access controls, allowing Keen employees to be granted access according to the Principle of Least Privilege
- Full customer data access audit history
- Lockdown of Keen employee devices, and/or limiting access to customer data to certain approved devices
** A note about data deletion **
During our many conversations with customers about their GDPR compliance efforts and concerns, the most common theme was the need for various types of data deletion. Some examples that we’ve heard include:
- specific property removal from all events
- deletion (or anonymization) of all events matching certain filters (e.g. all events with a specific user.id for “right to be forgotten” requests)
- one-time deletions of all data before some time threshold
- on-going “expiration” of data older than some horizon
While the Keen delete API endpoint can handle some of these at small scale, for larger use cases we felt that a more powerful toolset was needed. That toolset is now under active and on-going development, and is used internally. It can be run on customers’ behalf on a case-by-case basis. If you have GDPR-related deletion needs please contact us for more details.
Keep a lookout for more updates on our blog as we continue to make performance and security enhancements to Keen.
