vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information about Schematics service access roles and permissions for
* [Action permissions](https://cloud.ibm.com/docs/schematics?topic=schematics-accessaction-permissions)
* [KMS permissions](https://cloud.ibm.com/docs/schematics?topic=schematics-accesskms-permissions)









 Protecting data of Schematics 

Following are the various ways that Schematics data can be protected.



* Access protection by using Cloud Identity and Access Management.
* Non-repudiation by using Activity Tracker.
* Data protection by using Key Management Systems (KMS).





 Access protection by using Identity and Access Management 

Create an IAM access group for your users and assign service access policies to IBM Cloud Schematics and the resources that you want your users to work with. IAM users are attached to access groups. For more information, see [Setting up access for your users](https://cloud.ibm.com/docs/schematics?topic=schematics-accessaccess-setup).





 Non-repudiation by using Activity tracker 

You can use IBM Cloud® Activity Tracker to track and audit how users and applications interact with IBM Cloud Schematics. You can generate and maintain an audit trail for a Schematics Workspace instance events, access, events, and access audit log. For more information, see [Auditing events](https://cloud.ibm.com/docs/schematics?topic=schematics-at_events).





 Data protection by using KMS 

You can safeguard and encrypt your information from corruption, compromise, or loss in Schematics by:



* [KMS integration for BYOK or KYOK](https://cloud.ibm.com/docs/schematics?topic=schematics-kms-integration)
* [Managing data encryption](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-datapi-encrypt)
Schematics records few data about its users, which is limited to basic contact information such as email address, and name. Schematics is a data processor for said Personal Information (PI) data. Schematics processes the limited client PI in the course of running the service and optimizing the user experience. Schematics uses email for contacting clients. Monitoring client interactions with Schematics is another way Schematics processes PI.

Do not enter sensitive data for Schematics. For example, do not use any Personal Information (PI), Personal Identifying Information (PII), and customer-specific data in a workspace name.





 Is the Schematics database encrypted? 

For more information about how your data is encrypted in Schematics? see [How your data is stored and encrypted in Schematics?](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-datadata-storage)





 Data locations 

Locations where Schematics processes personal data are made available, and kept up-to-date. For more information about data locations, see [Locations and service endpoints](https://cloud.ibm.com/docs/schematics?topic=schematics-locations).





 Service security 

Following are the list of service security measures taken by the IBM Cloud Schematics.



* Physical and environmental security measures.
* Physical security of the data centers is handled by the IBM Cloud infrastructure providers. All hold externally audited certifications for the physical security. Schematics doesn't provide further details of the physical security controls in place at the data centers.
* Physical security of an office location that are used personnel is handled by IBM corporate.
* Technical and Organizational Measures. Technical and Organizational Measures (TOMs) are employed by Schematics to ensure the security of personal data. Schematics holds externally audited certifications for the controls Schematics employs.
* Service access to data.
* Schematics operations and support staff have access to client data and can access during routine operations. The access is only done to operate, and support the service.
Key Protect meets controls for global, industry, and regional compliance standards, including GDPR, HIPAA, and ISO 27001/27017/27018, and others.

For a complete listing of IBM Cloud compliance certifications, see [Compliance on the IBM Cloud](https://ibm.com/cloud/compliance).



 EU support 

Key Protect has extra controls in place to protect your Key Protect resources in the European Union (EU).

If you use Key Protect resources in the Frankfurt, Germany region to process personal data for European citizens, you can enable the EU Supported setting for your IBM Cloud account. To find out more, see [Enabling the EU Supported setting](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedbill_eusupported) and [Requesting support for resources in the European Union](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatareusupported).





 General Data Protection Regulation (GDPR) 

The GDPR seeks to create a harmonized data protection law framework across the EU. The regulation aims to give citizens back the control of their personal data, and impose strict rules on any entity that hosts and processes that data.

IBM is committed to providing clients and IBM Business Partners with innovative data privacy, security, and governance solutions to assist them in their journey to GDPR readiness.

To ensure GDPR compliance for your Key Protect resources, [enable the EU supported setting](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedbill_eusupported) for your IBM Cloud account. You can learn more about how Key Protect processes and protects personal data by reviewing the following addendums.



* [IBM Key Protect for IBM Cloud Data Sheet Addendum (DSA)](https://www.ibm.com/software/reports/compatibility/clarity-reports/report/html/softwareReqsForProduct?deliverableId=180A0EC0658B11E5A8DABB56563AC132)
Check whether Virtual Private Cloud (VPC) has no rules in the default security group<br> * Check whether App ID Cloud Directory users aren't able to self-sign up to applications<br> * Check whether all network interfaces of a virtual server instance have at least one Virtual Private Cloud (VPC) security group attached<br> * Check whether Virtual Servers for VPC instance has the minimum # interfaces<br> * Check whether App ID redirect URIs are using HTTPS only<br> * Check whether Cloud Internet Services (CIS) has TLS mode set to End-to-End CA signed<br> * Check whether Virtual Private Cloud (VPC) security groups have outbound ports that are open only to permitted IP addresses<br> * Check whether Application Load Balancer for VPC pool uses the HTTPS protocol for HTTPS listeners<br> * Check whether Application Load Balancer for VPC uses HTTPS (SSL & TLS) instead of HTTP<br> * Check whether Cloud Object Storage public access is disabled in IAM settings (not applicable to ACLs managed using S3 APIs)<br> * Check whether App ID anonymous authentication is disabled<br> * Check whether App ID avoid password reuse policy is enabled<br> * Check whether App ID user profile updates from client apps is disabled<br> * Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to RDP port<br> * Check whether App ID redirect URIs are not using localhost or 127.0.0.1<br> * Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to SSH port<br> * Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port<br><br><br>
Securing your data in App Configuration 

To ensure that you can securely manage your data when you use App Configuration, it is important to know exactly what data is stored and encrypted. It is also important to know how you can delete any stored data.



 What information is stored in App Configuration? 

The following information are stored when you use App Configuration service dashboard or API or CLI:



* Instance details
* Environments
* Collections
* Properties
* Features
* Segment rules



These information can be deleted using the APIs mentioned [here](https://cloud.ibm.com/apidocs/app-configuration). Deletion of above information is deleted permanently from the service.





 How your data is stored and encrypted in App Configuration 

App Configuration stores and encrypts definitions of environments, collections, features, properties and segment rules. This data is encrypted at rest. As a multi-tenant service, any data stored is encrypted with the default IBM provided key for all tenants.

IBM personnel have access to the configuration data. It is recommended to avoid storing sensitive information as part of the configuration. If sensitive data storage is required, consider using [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started).

You can add a higher level of encryption control to your data at rest (when it is stored) by enabling integration with a Key Management Service (KMS). The data that you store in IBM Cloud is encrypted at rest by using envelope encryption. If you need to control the encryption keys, you can integrate Key Protect or Hyper Protect Crypto Services. This process is commonly referred to as Bring Your Own Key (BYOK). With Key Protect and Hyper Protect Crypto Services, you can create, import, and manage encryption keys. You can assign access policies to the keys, assign users or service IDs to the keys, or give the key access only to a specific service.

For more information, see [Managing encryption](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-managing-encryption).
* [Data privacy](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-kubernetes-privacy)
* [GDPR](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-kubernetes-gdpr)





 Kubernetes cluster security 

The best place to start is to learn about the security features of the underlying Kubernetes infrastructure. The open source documentation provides a review of recommended practices for [securing a Kubernetes cluster](https://Kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/).

If you are using IBM Cloud, you can review the topic on Security for the [IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-security) or [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-security).





 Network security 

IBM Cloud provides the underlying network, including the networks and routers, over which customers’ VLAN resides. The customer configures their servers and uses gateways and firewalls to route traffic between servers to protect workloads from network threats. Protecting your cloud network by using firewalls and intrusion prevention system devices is imperative for protecting your cloud-based workloads.



 Firewall configuration 

Kubernetes clusters should be secured by a firewall to protect the network from unauthorized access from internet traffic. By default IBM Cloud Kubernetes service clusters are preconfigured with a Calico network plug-in that secures the public network interface of every worker node in the cluster. By configuring Kubernetes and Calico network policies you can easily control the inbound and outbound network traffic. For more information, see [Controlling traffic with network policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policies).
Retrieving key metadata 

You can retrieve the general characteristics of a single encryption key by using IBM® Key Protect for IBM Cloud®.

While you can [assign fine-grained access to a single key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keysgrant-access-key-level), note that calling the [list keys API](https://cloud.ibm.com/apidocs/key-protectgetkeys) will not return keys that you have assigned individual access to (that only you can access, in other words). Calling this API will however return the keys in key rings you have access to (if you have access to all of the keys in an instance, you will see all keys). You can, however, see the keys that only you have access to by following the instructions in [Granting access to keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keys) to view the key through IAM or by using the API to pass the specific key ID.

Retrieving a key requires a Writer or Manager access policy, but you might need a way to view only the details about a key, such as its transition history or configuration, without retrieving the key itself. If you have Reader acces permissions, you can use the Key Protect API to retrieve only metadata about a key.



 Viewing key metadata with the API 

To view detailed information about a specific key, you can make a GET call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys/<key_ID_or_alias>/metadata



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).
2. Retrieve the ID of the key that you would like to inspect.

The ID value is used to access detailed information about the key.
Securing your data in Event Notifications 

To ensure that you can securely manage your data when you use IBM Cloud® Event Notifications, you must know exactly what data is stored and encrypted and you must know how to delete any stored data.



 How your data is stored and encrypted in Event Notifications 

Event Notifications stores and encrypts details that are related to your destinations like email (sender, recipients, subject), or SMS (sender, recipient, details). As a multi-tenant service, every tenant has a designated encryption key and user data in each tenant is encrypted with only that tenant's key. This tenant key is protected by using Event Notifications managed Key Protect. Event Notifications ensures that private information is encrypted before it is stored.

You can add a higher level of encryption control to your data at rest (when it is stored) by enabling integration with a Key Management Service (KMS). The data that you store in IBM Cloud is encrypted at rest by using envelope encryption. If you need to control the encryption keys, you can integrate Key Protect or Hyper Protect Crypto Services. This process is commonly referred to as Bring Your Own Key (BYOK). With Key Protect and Hyper Protect Crypto Services, you can create, import, and manage encryption keys. You can assign access policies to the keys, assign users or service IDs to the keys, or give the key access only to a specific service.

For more information, see [Managing encryption](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-managing-encryption).





 Protecting your sensitive data in Event Notifications 

The data that you store in the Event Notifications instance is encrypted at rest by using a randomly generated key, which is in turn protected by Key Protect, managed by Event Notifications service.





 Deleting your data in Event Notifications 

The Event Notifications data retention policy describes how long your data is stored after you delete the service.
* Inspect which users have access to keys and if the level of access is appropriate.



For more information about auditing access to your resources, see [Managing user access](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access).



 Viewing keys in the console 

If you prefer to inspect the keys in your service by using a graphical interface, you can use the Key Protect dashboard.

[After you create or import your existing keys into the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys), complete the following steps to view your keys.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. Click on Keys, which shows a list of all keys in your service instance. Keys can be filtered by their Key states (for example, to show only keys in the Enabled state) or by their Key ring ID using the drop-down lists. Additionally, the individual values (such as Last rotated date), can be sorted. The search bar can be used to search keys by their display name, key ID, and alias. Note that the quickest way to find a key is to search by its key ID. The fields found in the table can be customized using the Settings button. By default you can see:





Table 1. Describes the Keys table.

 Column Description 

 Name The display name you gave to your key. 
 Key ID A unique key ID that was assigned to your key by the Key Protect service. You can use the ID value to make calls to the service with the [Key Protect API](https://cloud.ibm.com/apidocs/key-protect). 
 Key ring ID The [key ring](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys) the keys are associated with.
The unique identifier of the target key ring that you would like the newly create key to be a part of. If unspecified, the header is automatically set to 'default' and the key will sit in the default key ring in the specified Key Protect service instance. For more information, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). 
 correlation_ID Optional.The unique identifier that is used to track and correlate transactions. 
 return_preference A header that alters server behavior for POST and DELETE operations. When you set the return_preference variable to return=minimal, the service returns only the key metadata, such as the key name and ID value, in the response entity-body. When you set the variable to return=representation, the service returns both the key material and the key metadata. 
 key_name Required. A human-readable name for convenient identification of your key. To protect your privacy, do not store your personal data as metadata for your key. 
 alias_list Optional.One or more unique, human-readable aliases assigned to your key. Important: To protect your privacy, do not store your personal data as metadata for your key. Each alias must be alphanumeric, case sensitive, and cannot contain spaces or special characters other than - or _. The alias cannot be a UUID and must not be a Key Protect reserved name: allowed_ip, key, keys, metadata, policy, policies, registration, registrations, ring, rings, rotate, wrap, unwrap, rewrap, version, versions. Alias size can be between 2 - 90 characters (inclusive). 
 key_description Optional.An extended description of your key. To protect your privacy, do not store your personal data as metadata for your key. 
 expiration_date Optional.The date and time that the key expires in the system, in RFC 3339 format (YYYY-MM-DD HH:MM:SS.SS, for example 2019-10-12T07:20:50.52Z). The key will transition to the deactivated state within one hour past the key's expiration date.
They can assume the identity of that trusted profile.

You configure that someone or something else (see below) as part of the trusted profile setup. All the usual options are available, the IBM Cloud API, CLI, any of the available SDKs, Terraform or the IBM Cloud console.

In the console, as part of the IAM category, [trusted profiles](https://cloud.ibm.com/iam/trusted-profiles) have their own section. There, you can easily create and manage them. The following screenshot shows the second step of the dialog to create a trusted profile. You can [configure how to establish trust](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile), which entity can assume the identity of the trusted profile. It is one or more of:



* Federated users
* Compute resources
* IBM Cloud services
* Service IDs



Zoom

![Trusted profile entity types](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution68-trusted-profile-for-enterprise-security/IAM_TrustedProfile_create.png)

Trusted entity types





 Trusted profile use cases 

Trusted profiles are identities within IBM Cloud. They can be members of IAM access groups and thereby have assigned access privileges. Similar to users and service IDs, you can also directly assign access to trusted profiles. The distinguishing feature is the ability to configure a trusted profile, so that specific identities or resources can act under its identity. These identities and resources might be even located in other accounts. Thus, on a high level, the use case for using trusted profiles is to allow administrative work



* with a given set of privileges
* under a specific identity
* for identities or resources identified by a set of properties configured as part of the trusted profile.



The following scenarios are such use cases for trusted profiles, differing by the way the trust is established:
Here are a few common scenarios that explain how Key Protect can be used to solve issues faced by businesses operating at scale in production.



Table 1. Reasons to use Key Protect in various scenarios.

 Scenarios Reasons 

 As an IT admin for a large corporation, you need to integrate, track, and rotate encryption keys for many different service offerings. The Key Protect interface simplifies the management of multiple encryption services. With the service, you can manage and sort encryption keys in one centralized location, or you can separate keys by project and house them in different IBM Cloud spaces. 
 As a developer, you want to integrate your pre-existing applications, such as self-encrypting storage, to Key Protect. Apps on or outside IBM Cloud can integrate with the Key Protect APIs. You can use your own existing keys for your apps and import them into Key Protect. 
 Your development team has stringent policies, and you need a way to generate and rotate keys. With Key Protect, you can rapidly generate keys from an IBM Cloud hardware security module (HSM). When it's time to replace a key, whether it was created using Key Protect or imported, you can [rotate the key on-demand](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys) or [set a rotation policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) for the key to meet your on-going security needs. 
 You are a security admin in an industry, such as finance or legal, that must adhere to governance over how data is protected. You need to grant controlled access of keys without compromising the data that it secures. With the service, you can control user access to manage keys by [assigning different IAM roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles). For example, you can grant read-only access to users who need to view key creation information without viewing the key material. Similarly, users can be assigned the "Manager" role over only a single key, if needed.