WH I T E PA P E R

Private DataHandlingCONTENTS
PR I VAT E DATA H A N D L I N G

3PRINCIPLES

3PURPOSE

3PR I VAT E DATA H A N D L I N G

4Prerequisites

4

DATA S E CU R I TY

5Architecture

5

Example Flow

6

Data Handling

7

Inventory and Classification

7

Data: Return, Destruction & Disposal

7

Encryption in Transit

8

Encryption at Rest

8

Metadata Collection

8

DEPLOYMENT
Separation of Duties

9Patching

9

Vulnerability Management

9Third-Party Components

9

IDENTITY AND ACCESS MANAGEMENTRequirements

291010CREDENTIAL MANAGEMENT

10AUDIT10P
2 R I VAT E DATA H A N D L I N G WH I T E PA PE R

Private Data Handling
The following paper provides a preview of the security controls, architecture, and governance practices utilized to secure an Alteryx Analytics Cloud Platform private data plane.
This is a data processing cluster that customers can run on their own infrastructure to keep
data workloads within their own networks.

Principles
Alteryx powers analytics for all by providing
the leading analytics cloud platform. Alteryx delivers easy end-to-end automationof data engineering, analytics, reporting,machine learning, and data science processes, enabling enterprises everywhere
to democratize data analytics across theirorganizations for a broad range of use
cases. Our Alteryx Analytics Cloud Platform
is supported by a robust and comprehensive Information Security Program, which
is based on a defense-in-depth philosophy
and a secure by default approach. This program is designed to protect our platform
and our customers' data against potential
threats, and to ensure the integrity andreliability of our solutions. By implementing
these security measures, we provide ourcustomers with the confidence and peaceof mind to trust and rely upon our platform
to support their data analytics needs andaccelerate digital transformation.
By employing experts in information,
cyber, network, and application security,
Alteryx demonstrates its commitment tocontinually securing the company’s defensive systems, ensuring consistent security
review processes, maintaining our secure
infrastructure, and assuring adherence to
our Security Policies. Security is designed
into our products and operations.

3PR I VAT E DATA H A N D L I N G WH I T E PA PE R

We believe when products are built insecure environments, we create a more secure world to work out of, and our customers directly benefit from these protections.
Focusing on security and data protection
are among our primary design criteria.

PurposeAt Alteryx, we are committed to maintaining the highest standards of security andtransparency. We are dedicated to staying
ahead of the constantly evolving security landscape, and to implementing thelatest industry-specific standards and bestpractices to protect our customers' data.
Our comprehensive security measures aredesigned to prevent accidental or unlawfuldestruction, loss, alteration, unauthorized
disclosure, or unauthorized access to data.
This whitepaper is intended to provide an
overview of our security practices in theAlteryx Analytics Cloud Platform when
configured for private data handling and todemonstrate our commitment to ensuring
the integrity and reliability of our products,environment, and data. For more information about our overall security and privacy
programs, please visit alteryx.com/trust. We
look forward to working with you and tohelping you achieve your business objectives while protecting your data.

Private Data Handling
Private Data Handling refers to the overall architecture of
the Alteryx Analytics Cloud Platform that provides more
flexibility for data handling and storage. In simple terms,
the portions of the Alteryx Analytics Cloud Platform that
handle the customer’s internal data are deployed in amanner that gives the customer complete control overwhere their data is stored and processed. We utilize industry best practices to build comprehensive defense indepth security controls to give you confidence and meetcompliance obligations.
This is accomplished by creating multiple planes, which
we call the control plane, or the portion of the architecture that resides in Alteryx’s infrastructure, and the data
plane, which resides in your cloud infrastructure. The
control plane is responsible for user interface interactions,deployment capabilities, monitoring, storage of application metadata, and communication brokering. The data
plane is responsible for establishing connections to data
sources, the processing of data, and storage of uploaded
datasets and data samples at rest.
Third-party data storage or SQL execution engines suchas Snowflake, Databricks, or BigQuery are classified aspart of the data plane (where customer content is storedand processed), but those are not the focus of this paper.

Prerequisites
To support the deployment of the data plane infrastructure, a cloud account must be created with a VPC (VirtualPrivate Cloud) in a region of your choosing. Connectivity
must also be created between the data plane infrastructure and any other environments necessary to support
any workload use cases. Data plane infrastructure is deployable to an Amazon Web Services (AWS) environment.

4

PR I VAT E DATA H A N D L I N G WH I T E PA PE R

Data Security
Alteryx has taken great care to provide for the security
and integrity of data, regardless of where it resides oris transmitted within the Alteryx Analytics Cloud Platform infrastructure. Alteryx classifies data into two maincategories: customer content and application metadata.
Customer content belongs to the customer and refers tothe data that is being blended, transformed, analyzed, orprocessed. Application metadata is the data that Alteryx
uses to correctly process customer content as directed.

Architecture
The data plane segregation from the Alteryx environment
as well as other customer environments prevents co-mingling of data and helps ensure that no cross-tenant dataleakage can take place.
This network design approach separates the control
plane, which is responsible for routing and forwarding
decisions, from the data plane, which is responsible forforwarding data packets. This separation helps to improve
network security by isolating the control plane fromexternal attacks and preventing malicious actors fromgaining access to sensitive routing information. Additionally, this type of architecture allows for the use of different
security measures and controls on the control and data
planes, which can further enhance security posture.
The communication flows through the system are segregated such that control-related messages are directedto the Private Data Handling infrastructure, and return
messages contain only metadata about requested actions and sample data for display purposes. Sample data
is not centrally cached nor stored. Network communication over the public internet is encrypted with TLS 1.3
or higher. For the connection between the private data
plane and the data source, this remains true if supportedby the data source.

5PR I VAT E DATA H A N D L I N G WH I T E PA PE R

*Throughout
this paper,
references to“data” will refer
to customer
content, unlessotherwise noted.

Example Flow
For example, let us assume that you are a data engineer, and you want to retrieve records
from a cloud database, normalize the data into a dataset, and store the resulting records inan S3 bucket.
In this example, it is assumed that a workspace is configured with Single Sign-On (SSO)
integration, a data plane has successfully been deployed to your environment, andconfiguration of database credentials and IAM roles necessary have already been set up.

1.

The flow begins with you logging into
the Alteryx portal using your identity
provider for SSO authentication. Native
authentication may also be used ininstances where an external identity
provider is not available.

2.

You then utilize a configured databaseconnection as part of your workflow
and create a transformation of theresulting data to be stored in aconfigured S3 bucket.

3.

4.

6

5.

The data plane decrypts thecredentials utilizing keys stored
as secrets (also using envelopeencryption) and initiates theconnection to query the data.

6.

The data results are sent to the data
plane for processing.

7.

The private data plane processes thedata according to the workflow.

8.

The private data plane then utilizes
IAM credentials retrieved with an IAM
role to create an object in S3 with theresulting data.

9.

The data plane reports back status andsample data to the control plane.

The credentials configured for thedatabase have envelope encryption
applied and are sent to the data plane
for connecting to the data source.
The processing commands based on
the workflow design are also sent tothe data plane.

PR I VAT E DATA H A N D L I N G WH I T E PA PE R

10. Sample data is then streamed back toyour browser.

Data Handling
At Alteryx, we have implemented a set ofstandard policies and practices for data
inventory, classification, retention, andstorage that apply to our overall Analytics
Cloud Platform architecture and the deployment of Private Data Handling environments. This helps to ensure that data is easily accessible and can be quickly retrieved
when needed, while also protecting it
against unauthorized access or tampering.
Our commitment to standardization helps
to provide our customers with a consistentand reliable experience when using ourAnalytics Cloud Platform environments
and ensures that their data is properly
protected and managed.
Inventory and Classification
Policies regarding the appropriate tagging
of collected data according to the designated sensitivity are in place to ensure data isappropriately tracked and maintained.

7

PR I VAT E DATA H A N D L I N G WH I T E PA PE R

Data: Return, Destruction & Disposal
At Alteryx, we have implemented a comprehensive set of policies and proceduresfor the disposal of tangible and intangible
property, including data. These policies aredesigned to ensure that data is tracked,
reviewed, maintained, and disposed ofin a way appropriate to its sensitivity anddefined data retention periods. This meansthat data is only retained for the periodrequired by applicable legal and contractual requirements, after which it is securely
disposed of. By following these policies, wecan ensure that customer content is properly handled and protected throughout its
entire lifecycle. This helps to maintain thesecurity and integrity of the data and prevents potential breaches or unauthorizedaccess. Our commitment to secure data
disposal helps our customers with peace ofmind that their data is handled responsiblyand securely.

Encryption in Transit

Metadata Collection

To help ensure the security of data intransit within Alteryx systems, including
the Private Data Handling infrastructure
deployed in the customer environment, weutilize Transport Layer Security (TLS) version
1.3 or higher.

A set of application monitoring usage datais collected from the Private Data Handlingenvironment to monitor and maintain thesystem’s operational stability. This metadata is a small sampling of the overall
workflow data and is carefully aggregated,
obfuscated, and then utilized to provide
valuable insights into the system's performance. This helps to ensure that the Private
Data Handling environment is runningsmoothly and efficiently and allows for proactive identification and resolution of any
potential issues or bottlenecks.

This encryption protocol helps to prevent
unauthorized access to data as it is transmitted between different components ofthe system. Additionally, control plane todata plane communication and intra-cluster communication are both encrypted tofurther protect customer content. Thesemeasures ensure that data remains secure
as it is transmitted within the Alteryx system and prevents potential vulnerabilitiesor breaches. By implementing encryption
in transit, we can provide our customers
with the peace of mind that their data isprotected and secure.
Encryption at Rest
Data stored within a workspace is encrypted at rest by default utilizing 256-bit Advanced Encryption Standard (AES) blockciphers, and cloud native services for key
management versioning and rotation.
• Secrets within the data plane cluster areencrypted using envelope encryption
separate from workloads supported bycustomer-managed keys.
• Customers can use encrypted storage
buckets and databases as data sources.
Customer data sources outside of the workspace will adhere to the underlying encryption policy for that data source. For example, if a customer connects to an S3 bucket
as an external data source, any files there
will follow the customer-defined policy.

8PR I VAT E DATA H A N D L I N G WH I T E PA PE R

By regularly monitoring and analyzing
the metadata, Alteryx ensures our customers’ environments are stable and reliable,
while allowing us to make informed decisions about how to optimize and improvetheir performance.
Alteryx also collects a set of application
usage data through the browser as endusers interact with the application. Like
monitoring data, this usage data is also
aggregated and obfuscated. Alteryx
analyzes this metadata for insight into how
end-users interact with the app, utilizationof features, and opportunities to improvethe end-user experience.

Deployment
Separation of Duties
Alteryx creates the necessary infrastructure to run data plane management within acustomer’s cloud account. No existing infrastructure, such as network and storage, ismodified during this process. All necessary infrastructure created during deployment
complements any existing infrastructure, and no changes are made to governance policies
in the environment.

Patching
Clusters in the data plane are updated regularly with security-patched images.
Patching of components in the data planeis accomplished using a continuous delivery flow, which ensures that updates arequickly and seamlessly deployed to the system. This process begins when updates arepushed to the Alteryx repositories, whichcontain images that have undergone thorough testing and verification. When a new
update is available, it triggers a deployment
to the private data plane, which installs theupdate and ensures that the data planeremains up-to-date and secure. This continuous delivery flow allows for efficient andeffective data plane patching and helps
prevent security vulnerabilities and maintains the system's stability and reliability. By
implementing this process, Alteryx ensuresthat the data plane is always up-to-dateand protected against potential threats.

Vulnerability Management
Workload images deployed utilize thesame secure Software Development LifeCycle (SDLC) practices we utilize across thecompany. Containers begin with hardenedbaseline images and are scanned for any
potential vulnerabilities.
For more information about our SDLC practices or information security program visit
alteryx.com/trust.

9PR I VAT E DATA H A N D L I N G WH I T E PA PE R

Scanning at Alteryx includes static, dynamic, software composition, infrastructure
code, and image vulnerability analysis.
Security patching of workload images isdetermined by the criticality of any potential vulnerabilities that might exist, and theprocess follows the Alteryx vulnerability
policy. In general, images are pushed using
rolling updates within the cluster.
Cloud services utilized in the private data
plane are patched according to the schedules set by AWS.

Third-Party Components
The following describes third-party workload images utilized for operations within
the data plane. Images utilized from thevendor are always patched with the latest
security updates.

COMPONENT

USAGE

ArgoCDManagement of cluster workloads

DataDog

Relays cluster metrics andtelemetry

Teleport

Remote connections for support

Identity and Access
ManagementRequirements
The Alteryx Analytics Cloud Platform integrates
with AWS IAM with a least-permissions model forservices and users to get appropriate access. An
IAM (Identity and Access Management) accountand an associated role with a required set ofpermissions must be provided to Alteryx by thecustomer to support initial deployment.
This account and role are utilized for initial
deployment purposes and for any necessarychanges to the data plane infrastructure neededby Alteryx. Configuration scripts are available toautomatically create the necessary permissions.

Credential Management
Connections to various systems for building
datasets are initiated by the data plane only.
Credentials are stored utilizing envelope
encryption. A data encryption key (DEK) is used toencrypt the credentials, while a key encryption key(KEK) is used to encrypt the key. This encryption isused for both storage and while in transit.
The data plane integrates with cloud-native
Identity and Access Management services to utilize
roles for data access without the need for storageof credentials in the environment.

Audit
Because the data plane runs within yourenvironment, the governance and configurationof logging you have applied will also apply to thedata plane. Events that occur such as infrastructurechanges and account access will be logged andreviewable according to your logging policy.

10PR I VAT E DATA H A N D L I N G WH I T E PA PE R

Analytics for all employees, systems, and decisions.
Accelerate your analytics journey with the Alteryx
Analytics Cloud Platform.
Explore Now

The Alteryx Analytics Cloud Platform empowers you to tackle your toughest business problems with powerfuland easy-to-use analytics in one platform. Quickly share workflows with ease across cloud, desktop, andon-prem. You can gain quick insights with cloud-native analytics all in the browser. Get ready to experience
seamless out-of-the-box integrations with modern cloud ecosystem applications. Utilize Alteryx Analytics
Cloud Platform to surface hidden signals and focus on what matters with AI-driven, automated insights, andimpact outcomes with built-in recommendations and best practices shaped by the Alteryx Community.

alteryx.com