vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information about redirect URIs, see [Adding redirect URIs](https://cloud.ibm.com/docs/appid?topic=appid-managing-idpadd-redirect-uri).

Do not include any query parameters in your URL. They are ignored in the validation process. Example URL: http://host:[port]/path





 How does encryption work in App ID? 

Check out the following table for answers to commonly asked questions about encryption.



Table 2. Frequently asked questions about how App ID handles encryption

 Question Answer 

 Why do you use encryption? One way that we protect our users' information is by encrypting customer data at rest and in transit. The service encrypts customer data at rest with per-tenant keys and enforces TLS 1.2+ in all network segments. 
 Which algorithms are used in App ID? The service uses AES and SHA-256 with salting. 
 Do you use public or open source encryption modules or providers? Do you ever expose encryption functions? The service uses avax.crypto Java libraries, but never exposes an encryption function. 
 How are keys stored? Keys are generated, encrypted with a master key that is specific to each region, and then stored locally. The master keys are stored in [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial). Each region has its own root-of-trust key that is stored in [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial), which is backed up by HSM. Each service instance (tenant) has its own data encryption and token signature keys, which are encrypted by using the region's root-of-key trust. 
 What is the key strength that you use? The service uses 16 bytes. 
 Do you invoke any remote APIs that expose encryption capabilities No, we do not. 







 What clock synchronization does App ID use?
The Cloud Service cannot be used for the transmission, storage, or other usage of any Health Data protected under HIPAA unless (i) Client provides IBM such notification; (ii) IBM and Client have entered into an applicable Business Associate Agreement; and (iii) IBM provides Client with express written confirmation that the Cloud Service can be used with Health Data. In no event shall the Cloud Service be used for processing PHI as a healthcare clearinghouse within the meaning of HIPAA.

If a system failure occurs, a third-party service provider might request debugging artifacts from the client (logs, core memory dumps). It is the client’s sole responsibility to gather and transmit these artifacts to the third-party provider. The IBM support team might assist by providing links to documentation or providing direction through screen sharing sessions. However, the client is responsible for cleansing the data of any PHI and ensuring that it is properly encrypted before transmitting. It is also the client’s responsibility to evaluate whether they require a BAA to be executed with the third-party provider before sending data.







 Personal information and regulated data 

This Cloud Service is not designed to any specific security requirements for regulated content, such as personal information or sensitive personal information. Client is responsible to determine whether this Cloud Service meets Clients needs regarding the type of content Client uses in connection with the Cloud Service.





 Policy for accessing clients' instances 

VMware vCenter Server environments, which are delivered as IBM Cloud for VMware Solutions, provide a VMware® management platform layer for our clients to manage the virtualization capabilities. Throughout the lifecycle of VMware Solutions products and services, IBM Support might be required to help guarantee their success. Usually, intervention by IBM Support is the result of a client request (that is, a support ticket). However, on rare occasions, IBM Support might assist proactively and without a client–written support ticket to prevent future issues. This access is through the IBM Cloud internal support network and is documented through a support ticket that is opened by IBM Support and continuously monitored by IBM Cloud SOC. At no time will IBM Support modify the instance configuration without prior consent from the client. Access is to the VMware management components and the IBM Cloud management components and never to the client virtual machines or applications.





 Proactive support
Deploying a sample application on Hyper Protect Virtual Server for VPC 

This tutorial walks you through the steps to deploy a sample application on Hyper Protect Virtual Server for VPC, which highlights how Confidential Computing can help protect Personally Identifiable Information (PII).



 Introduction 

Confidential Computing is the protection of data-in-use through a hardware-based technique. The sample application "PayNow" obtains and processes PII and credit card information for a financial transaction.

You can provision Hyper Protect Virtual Servers with the advantage of [IBM Secure Execution for Linux](https://www.ibm.com/docs/en/linux-on-systems?topic=virtualization-introducing-secure-execution-linux) on IBM Cloud Virtual Private Cloud (VPC) or On-Premises. In this tutorial, we use Hyper Protect Virtual Servers for VPC.

Zoom

![Data in financial transactions are protected by Confidential Computing on Hyper Protect Virtual Server for VPC.](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/paynow-code-pattern.svg)

Figure 1. Data in financial transactions are protected by Confidential Computing on Hyper Protect Virtual Server for VPC





 Before you begin 

To complete this tutorial, you need to meet the following prerequisites:



1. Create an IBM Cloud account.
2. [Create an API key](https://cloud.ibm.com/docs/account?topic=account-userapikey) for your user identity.
3. [Install IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli) and the [container registry CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-devtools-manuallyidt-install-container-registry-cli-plugin).
4.
You can check the certificates at the following sites:



* [IBM 4769-001 Cryptographic Coprocessor Security Module](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4079)
* [IBM 4768 Cryptographic Coprocessor Security Module](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3410)







 General Data Protection Regulation 

The General Data Protection Regulation (GDPR) seeks to create a harmonized data protection law framework across the European Union and aims to give citizens back the control of their personal data. GDPR also imposes strict rules on enterprises that are hosting and processing data, anywhere in the world.

IBM is committed to providing you with innovative data privacy, security, and governance solutions to assist you in the journey to GDPR readiness.

To ensure GDPR compliance for your Hyper Protect Crypto Services resources, [enable the EU supported setting](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedbill_eusupported) for your IBM Cloud account. You can learn more about how Hyper Protect Crypto Services processes and protects personal data by reviewing the following addendums.



* [IBM Hyper Protect Crypto Services Data Sheet Addendum (DSA)](https://www.ibm.com/software/reports/compatibility/clarity-reports/report/html/softwareReqsForProduct?deliverableId=46E9C81025D811E895B382FBC780E8BA)
* [IBM Data Processing Addendum (DPA)](https://www.ibm.com/support/customer/csol/terms/?id=DPA-DPL)







 HIPAA support 

Hyper Protect Crypto Services meets controls for the US Health Insurance Portability and Accountability Act (HIPAA) to ensure safeguarding of protected health information (PHI).

If you or your company is a covered entity as defined by HIPAA, you can enable the HIPAA Supported setting for your IBM Cloud account.
"allowed_network": "public-and-private"
}
}
}
]





 Required parameters 

-i, --instance-ID
: The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command.

$ export KP_INSTANCE_ID=INSTANCE_ID





 Optional parameters 

-a, --allowed-network
: Show the instance policy for "allowed network".







 kp instance policy-update allowed-network 

Update the policy for an instance and set the allowed network to public-and-private or private-only.

The allowed-network policy blocks an instance from getting requests from public or private networks.

For existing instances the network access policy is enforced after it is set.

For more information, see [managing network access policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-managing-network-access-policies).

ibmcloud kp instance policy-update allowed-network
-i, --instance-id INSTANCE_ID
-d, --disable OR
-e, --enable
-t, --network-type NETWORK_TYPE



 Example 

This example sets the "allowed network" policy to "public-and-private".

 update the instance policy and set the allowed network to public-and-private
$ ibmcloud kp instance policy-update allowed-network --enable --network-type public-and-private

Updating instance policy...
OK

 list the instance policies
$ ibmcloud kp instance policies

Retrieving policy details for instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Created By user id ...<redacted>...
Creation Date 2020-06-22T16:17:52Z
Last Updated 2020-06-22T18:17:32Z
Updated By user id ...<redacted>...
Policy Type allowedNetwork
Enabled true
IBM provides storage policies for these data stores that offer vSphere encryption and customers can choose to apply these policies to their workloads so that VMs are protected by vSphere encryption.

The use of vSphere encryption is not enforced by IBM because it is not desirable in every instance. There are unique scenarios for each customer deployment and it's a customer selectable option to enable disk encryption for workloads.

VMs encrypted by vSphere encryption are protected by an IBM-owned Key Protect instance with unique Key Protect instance, unique root key, and unique data encryption key per instance. Additionally, customer backups are stored in separate storage that is protected by Veeam® encryption, which generates keys automatically for each tenant or backup job.

There are several possible instances of customer data in motion. Customer network data flows over NSX-T virtualized overlay network segments and is isolated to the customer. NSX-T virtualized overlay networking does not provide intrinsic encryption, so if you want confidentiality, you must use a different technique such as IPsec, SSL, or SSH. Customer disk traffic in flight is protected if customers use vSphere encryption. Customer vMotion traffic in flight is protected by enforcing the use of vMotion encryption.

Client-owned data includes the following items:



* VMs
* Backups
* Data-in-motion on the IBM Cloud networks and SDN networks
* Customer configurations used in the solution, such as connections to on-premises and user authentication in the solution



In all cases, data must be resilient to support solution continuity and recovery if a disaster occurs.







 Related links 



* [Securing your data in VMware as a Service](https://cloud.ibm.com/docs/vmware-service?topic=vmware-service-vmaas-data-security)
For both entity types, the level of access that is granted is determined by the access policies that are specified within each trusted profile, or the access groups that the trusted profile is a member of. However, trusted profiles don't require federated users to be invited to an account, and only users that are federated by an external identity provider (IdP) can apply a trusted profile.

When you're a member of multiple access groups, all policies apply at once when you access an account. As a federated user, you might have the option to apply different trusted profiles, but you select just one profile to apply when you log in. For example, if you want to complete developer-related tasks, select the Developer profile when logging in. If you want to complete an administrator-related task, you select the Admin profile that has privileged permissions. This way, you reduce the risk of taking privileged actions by mistake.

A policy consists of a subject, target, and role. The subject in this case is the access group or trusted profile. The target is what you want the subject to access, such as a set of resources in a resource group, a service instance, all services in the account, or all instances of a service. The role defines the level of access that is granted.

For more information about how platform and services roles work in Key Protect, check out [Platform roles and service roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).



 Best practices 

There is a [limit](https://cloud.ibm.com/docs/account?topic=account-known-issuesiam_limits) on the total number of policies that are allowed in an account. You can use a few strategies to ensure that you don't reach the limit and to reduce the amount of time that you spend managing access for the identities in your account (users, service IDs, or trusted profiles):



* Use the principle of least privilege and assign only the access that is necessary. This can help you ensure that the identities in your account are limited to only the actions that you want to allow.
Most successful requests have unique requestData and responseData associated with each related event. The following sections describe the data of each Key Protect service action event.

Fields are not guaranteed to appear unless the request is successful.



 Common Fields 

There are some common fields that Key Protect uses outside of the CADF event model to provide more insight into your data.



Table 8. Describes the common fields in IBM Cloud Activity Tracker events for Key Protect service actions.

 Field Description 

 requestData.requestURI The<br><br>URI<br><br>of the API request that was made. 
 requestData.instanceID The unique identifier of your Key Protect instance. 
 correlationId The unique identifier of the API request that generated the event. 



For more information on the event fields in the Cloud Auditing Data Federation (CADF) event model, see [Event Fields](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-event)

While initiator.host.address is a field that is part of the Cloud Auditing Data Federation model, the host address field will not be shown for requests made through private networks.





 Conditional Common Fields 

There are some conditional fields that Key Protect uses outside of the CADF event model to provide more insight into your data when you use the key ring feature. These fields will appear when using key rings in specific conditions.



Table 9. Describes conditional fields for use with key rings in IBM Cloud Activity Tracker events for Key Protect service actions.

 Field Description 

 requestData.keyRingId The ID of the key ring if a key ring is specified in the header (X-Kms-Key-Ring) of the request. 
 responseData.keyRingId The ID of the key ring if a key ring is specified in the request or in API methods where the key ID (or alias) is in the path of the request<br><br>URI<br><br>. 







 Key action events 

Due to the sensitivity of the information for an encryption key, when an event is generated as a result of an API call to the Key Protect service, the event that is generated does not include detailed information about the key, such as the payload and encrypted nonce.
Application administration, including the logging configuration, are the responsibility of the customer, and it is highly recommended that logging PII/SPI not be configured unless absolutely required. The following document describes how to configure logs to exclude any data classified as PII or SPI:

[https://www.ibm.com/support/pages/node/2801463](https://www.ibm.com/support/pages/node/2801463)

IBM Data Security and Privacy Principles for IBM Cloud services can be found at the link below: [https://www.ibm.com/support/customer/csol/terms/?cat=data-security](https://www.ibm.com/support/customer/csol/terms/?cat=data-security)

IBM Privacy Shield Privacy Policy for Certified IBM Cloud Services can be found below. This is applicable to EU-US and Swiss-US customers: [https://www.ibm.com/privacy/details/us/en/privacy_shield.html](https://www.ibm.com/privacy/details/us/en/privacy_shield.html)

Data Responsibility at IBM [https://www.ibm.com/blogs/policy/dataresponsibility-at-ibm/](https://www.ibm.com/blogs/policy/dataresponsibility-at-ibm/) If a government wants access to data held by IBM on behalf of a MAS-Dedicated client, IBM would expect that government to deal directly with that client

Data Processing Addendum (GDPR)

[https://www.ibm.com/support/customer/csol/terms/?id=Z126-7870&lc=en#detail-document](https://www.ibm.com/support/customer/csol/terms/?id=Z126-7870&lc=endetail-document)





 Data Privacy and Subject Rights 

IBM Privacy Statement IBM's Privacy Statement describes IBM's general privacy practices and subject rights that apply to personal information. For complete statement details click on the link below.
Securing your data in Direct Link 

Direct Link does not store any customer data. Data transmitted through a direct link gateway is not encrypted by IBM.

Data about your specific Direct Link configuration are encrypted in transit and at rest. Configuration data is deleted upon your request through API or User Interface.



  How your data is stored and encrypted in Direct Link 

All interaction with Direct Link from clients is encrypted. For example, when a client uses an API or interacts with the service via User Interface to configure gateways and connections, all such interactions are fully end-to-end encrypted. Likewise, data elements related to the clients' configuration are encrypted in transit and at rest. No personal or sensitive data is stored, processed, or transmitted. Data at rest is stored in an encrypted database.

However, the result of using Direct Link is to join customer networks together. After networks are joined together, for example from on-premises networks to a VPC, the encryption of data that clients choose to transmit across the network is the client's responsibility.





  Protecting your sensitive data in Direct Link 

All data related to Direct Link's configuration is not considered as sensitive data. The configuration data is encrypted at rest at the database level. No customer-managed keys are managed by the Direct Link offering. Therefore, neither Key Protect nor Hyper Protect Crypto Services are used.



  About customer-managed keys 

No customer-managed keys are managed by the Direct Link offering. Therefore, neither Key Protect nor Hyper Protect Crypto Services are used.





  Enabling customer-managed keys for Direct Link 

No customer-managed keys are managed by the Direct Link offering. Therefore, neither Key Protect nor Hyper Protect Crypto Services are used.





  Working with customer-managed keys for Direct Link 

No customer-managed keys are managed by the Direct Link offering. Therefore, neither Key Protect nor Hyper Protect Crypto Services are used.







  Deleting your data in Direct Link 

The Direct Link configuration is deleted on request through the API or user interface.



  Deleting Direct Link instances 

The Direct Link configuration is deleted on request through the API or user interface.





  Restoring deleted data for Direct Link 

Direct Link does not support the restoration of deleted data.
Data privacy is achieved by using [private data collections](https://hyperledger-fabric.readthedocs.io/en/release-1.4/private-data/private-data.htmlwhat-is-a-private-data-collection). For example, several wholesalers and a set of farmers might be joined to a single channel. If a farmer and a wholesaler want to transact privately, they can create a channel for this purpose. But they can also decide to create a private data collection on the smart contract that governs their business interactions to maintain privacy over sensitive aspects of the sale, such as the price, without having to create a secondary channel. To learn more about when to use private data within a blockchain, visit the [Private Data](https://hyperledger-fabric.readthedocs.io/en/release-1.4/private-data/private-data.htmlprivate-data) concept article in the Fabric documentation.

In order to use private data with IBM Blockchain Platform, the following three conditions must be satisfied:



1. Define the private data collection. A private data collection file can be added to your smart contract. Then, at run time, your client application can use private data-specific chaincode APIs to input and retrieve data from the collection. For more information about how to use private data collections with your smart contract, see the Fabric SDK tutorial on [Using private data](https://hyperledger.github.io/fabric-sdk-node/release-1.4/tutorial-private-data.html) in the Fabric SDK documentation.
2. Deploy the smart contract. After you define the smart contract private data collection, you need to install the smart contract on the peers that are members of the channel. When you instantiate the smart contract on the channel by using the console, you need to upload the collection configuration JSON file. For more information on how to [create a collection definition JSON file](https://hyperledger.github.io/fabric-sdk-node/release-1.4/tutorial-private-data.html) see the Fabric SDK documentation topic.
You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.<-- </section "id="section-en-notice-patents" "> --><-- <section "id="section-en-notice-no-surrender" "> --> 12. No Surrender of Others' Freedom If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.<-- </section "id="section-en-notice-no-surrender" "> --><-- <section "id="section-en-notice-use-gnu" "> --> 13. Use with the GNU Affero General Public License Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work.