vania-janet/multiturn-rag-retrieval-data huggingface dataset:
This is applicable to EU-US and Swiss-US customers: [https://www.ibm.com/privacy/details/us/en/privacy_shield.html](https://www.ibm.com/privacy/details/us/en/privacy_shield.html)

Data Responsibility at IBM [https://www.ibm.com/blogs/policy/dataresponsibility-at-ibm/](https://www.ibm.com/blogs/policy/dataresponsibility-at-ibm/) If a government wants access to data held by IBM on behalf of a SaaS client, IBM would expect that government to deal directly with that client

Data Processing Addendum (GDPR)

[https://www.ibm.com/support/customer/csol/terms/?id=Z126-7870&lc=en#detail-document](https://www.ibm.com/support/customer/csol/terms/?id=Z126-7870&lc=endetail-document)





 Data Privacy and Subject Rights 

IBM Privacy Statement IBM's Privacy Statement describes IBM's general privacy practices and subject rights that apply to personal information. For complete statement details click on the link below. [https://www.ibm.com/privacy/us/en/](https://www.ibm.com/privacy/us/en/)

Right to Lodge a Complaint In the event a client or customer considers our processing of personal information not to be compliant with applicable data protection laws, a complaint can be submitted directly with IBM by using the form in the link below. [https://www.ibm.com/scripts/contact/contact/us/en/privacy/](https://www.ibm.com/scripts/contact/contact/us/en/privacy/)





 NIST 

IBM Maximo Application Suite Manage Servers (commercial public offerings) follow NIST guidelines and assess against NIST controls, but claim no specific NIST compliance(s).





 Data Leakage Prevention / Data Loss Prevention (DLP) 

IBM Cloud Delivery Services does not use DLP monitoring. Access controls are implemented on all databases restricted to privileged users only.
To protect your privacy, do not store your personal data as metadata for your key. 
 key_description An extended description of your key. To protect your privacy, do not store your personal data as metadata for your key. 
 YYYY-MM-DD<br><br>HH:MM:SS.SS The date and time that the key expires in the system, in RFC 3339 format. If the expirationDate attribute is omitted, the key does not expire. 
 key_material The base64 encoded key material, such as an existing key-wrapping key, that you want to store and manage in the service. For more information, see [Base64 encoding your key material](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-root-keysencode-key-material-root-key). Ensure that the key material meets the following requirements:<br><br><br><br> * The key must be 16, 24, or 32 bytes long, corresponding to 128, 192, or 256 bits.<br> * The key must be base64-encoded.<br><br><br> 
 key_type A boolean value that determines whether the key material can leave the service. When you set the extractable attribute to false, the service designates the key as a root key that you can use for wrap or unwrap operations. 



To protect the confidentiality of your personal data, avoid entering personally identifiable information (PII), such as your name or location, when you add keys to the service. For more examples of PII, see section 2.2 of the [NIST Special Publication 800-122](https://www.nist.gov/publications/guide-protecting-confidentiality-personally-identifiable-information-pii).

A successful POST api/v2/keys response returns the ID value for your key, along with other metadata. The ID is a unique identifier that is assigned to your key and is used for subsequent calls to the Hyper Protect Crypto Services key management service API.
3. Optional: Verify that the key was added by running the following call to browse the keys in your Hyper Protect Crypto Services service instance.
For more examples of personal data, see section 2.2 of the [NIST Special Publication 800-122](https://www.nist.gov/publications/guide-protecting-confidentiality-personally-identifiable-information-pii).
* Can encryption keys that are created in one region be used in another region?

Your encryption keys can be used to encrypt data stores located anywhere within IBM Cloud.
* How do I control who has access to keys?

Key Protect supports a centralized access control system, governed by IBM Cloud® Identity and Access Management, to help you manage users and access for your encryption keys and allow the principle of least privilege. If you are a security admin for your service, you can assign [IBM Cloud IAM roles that correspond to the specific Key Protect permissions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles) you want to grant to members of your team.

One way this is possible is by grouping keys into "key rings", allowing an account owner to assign access to a particular group of keys to a particular group of users. For more information, check out [Grouping keys together using key rings](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys).
* What are differences between the Reader and ReaderPlus roles?

Both the Reader and ReaderPlus roles help you assign read-only access to Key Protect resources.



* As a Reader, you can browse a high-level view of keys and perform wrap and unwrap actions. Readers cannot access or modify key material.
* As a ReaderPlus, you can browse a high-level view of keys, access key material for standard keys, and perform wrap and unwrap actions. The ReaderPlus role cannot modify key material.



* How do I monitor API calls to Key Protect?

You can use the IBM Cloud Activity Tracker service to track how users and applications interact with your Key Protect instance. For example, when you create, import, delete, or read a key in Key Protect, an Activity Tracker event is generated.
[https://www.ibm.com/support/customer/csol/terms/?id=Z126-7870&lc=en#detail-document](https://www.ibm.com/support/customer/csol/terms/?id=Z126-7870&lc=endetail-document)





 Data Privacy and Subject Rights 

IBM Privacy Statement IBM's Privacy Statement describes IBM's general privacy practices and subject rights that apply to personal information. For complete statement details click on the link below. [https://www.ibm.com/privacy/us/en/](https://www.ibm.com/privacy/us/en/)

Right to Lodge a Complaint In the event a client or customer considers our processing of personal information not to be compliant with applicable data protection laws, a complaint can be submitted directly with IBM by using the form in the link below. [https://www.ibm.com/scripts/contact/contact/us/en/privacy/](https://www.ibm.com/scripts/contact/contact/us/en/privacy/)





 NIST 

IBM Maximo Application Suite Manage Servers (commercial public offerings) follow NIST guidelines and assess against NIST controls, but claim no specific NIST compliance(s).





 Data Leakage Prevention / Data Loss Prevention (DLP) 

IBM SRE team does not use DLP monitoring. Access controls are implemented on all databases restricted to privileged users only. Database auditing is enabled and logs are retained for 365 days. Customers configure and manage the data their users can view, update and export within the Maximo Application Sutie applications, as well as determine which of their users is permitted direct read-only access to their database(s).

IBM purchases Professional Errors and Omissions including cyber risk insurance (see below) for IBM's liability arising out of actual or alleged breach of duty, neglect, error, misstatement, misleading statements or omission committed in the conduct of IBM’s professional services. This includes coverage for loss of intangible property, such as customer data, due to IBM’s negligence. This coverage is global in scope.





 DDoS Protection
[https://www.ibm.com/support/customer/zz/en/dpa.html](https://www.ibm.com/support/customer/zz/en/dpa.html)





 Data Privacy and Subject Rights 



* IBM Privacy Statement



IBM's Privacy Statement describes IBM's general privacy practices and subject rights that apply to personal information. For complete statement details click on the link below. [https://www.ibm.com/privacy/us/en/](https://www.ibm.com/privacy/us/en/)



* Right to Lodge a Complaint



In the event a client or customer considers our processing of personal information not to be compliant with applicable data protection laws, a complaint can be submitted directly with IBM by using the form in the link below. [https://www.ibm.com/scripts/contact/contact/us/en/privacy/](https://www.ibm.com/scripts/contact/contact/us/en/privacy/)





 NIST 



* IBM TRIRIGA Application Suite Manage Servers (commercial public offerings) follow NIST guidelines and assess against NIST controls, but claim no specific NIST compliance(s).







 Data Leakage Prevention / Data Loss Prevention (DLP) 



* IBM Cloud Delivery Services does not use DLP monitoring. Access controls are implemented on all databases restricted to privileged users only. Database auditing is enabled and logs are retained for 365 days. Customers configure and manage the data their users can view, update and export within the TRIRIGA Application Suite applications, as well as determine which of their users is permitted direct read-only access to their database(s).
* IBM purchases Professional Errors and Omissions including cyber risk insurance (see below) for IBM's liability arising out of actual or alleged breach of duty, neglect, error, misstatement, misleading statements or omission committed in the conduct of IBM’s professional services. This includes coverage for loss of intangible property, such as customer data, due to IBM’s negligence. This coverage is global in scope.







 DDoS Protection 



* IBM Cloud provides DDoS (Distributed Denial of Service) protection for its environment, designed to protect the entire network.
For more information about envelope encryption, see [Protecting your sensitive data in VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-mng-datadata-encryption).

All your interaction with VPN for VPC is encrypted. For example, when you use an API or interact with the service through the User Interface to configure VPN gateways and VPN connections, all such interactions are encrypted end-to-end. Likewise, data elements that are related to your configuration are encrypted in transit and at rest. No personal or sensitive data is stored, processed, or transmitted. Data at rest is stored in an encrypted database.

After the VPN for VPC is provisioned and the network connections are created, the encryption of data that you choose to transmit across the network is your responsibility.



 Instance storage data isolation and encryption 

The instance storage disk or disks, which are attached to the virtual server instance, cannot be shared with any other virtual servers and cannot be accessed by any other virtual servers in the future. They are one-time use, single-attach, for the virtual server that requested the instance storage.

Instance storage data is secured with on-disk encryption. The physical disks that are used for instance storage are self-encrypting with the strong AES-256 encryption standard. The data is automatically decrypted when your instance accesses the data. When your instance is shut down or deleted, the underlying storage space is erased and unrecoverable. At that point, the data is unrecoverable. For more information, see [Introduction to encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-basics).

Data is automatically encrypted on the physical media at the drive level. However, customer-managed keys are not supported for instance storage. For sensitive data, it is strongly recommended that users utilize software-based file system encryption such as LUKS for Linux® or BitLocker for Windows®.
UL-2 - Information Sharing With Third Parties 



  Control requirements 

The organization:

UL-2 (a)
:   Shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes.

UL-2 (b)
:   Where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the PII covered and specifically enumerate the purposes for which the PII may be used.

UL-2 (c)
:   Monitors, audits, and trains its staff on the authorized sharing of PII with third parties and on the consequences of unauthorized use or sharing of PII.

UL-2 (d)
:   Evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required.
To protect your privacy, ensure that the key name does not contain personally identifiable information (PII), such as your name or location. Note that key names do not need to be unique. 
 Key alias Optional. [Key aliases](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-key-alias) are ways to describe a key that allow them to be identified and grouped beyond the limits of a display name. Keys can have up to five aliases. 
 Key ring Optional. [Key rings](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys) are groupings of keys that allow those groupings to be managed independently as needed. Every key must be a part of a key ring. If no key ring is selected, keys are placed in the default key ring. Note that to place the key you're creating in a key ring, you must have the Manager role over that key ring. For more information about roles, check out [Managing user access](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access). 
 Rotation policy Optional. If you hold the [Manager role](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access), you can set a rotation policy for the key at key-creation time. If an [instance policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-policies-instance) exists to create rotation policies on keys by default, you can also overwrite that policy at key-creation time to a different interval. Note that if your instance has a rotation policy enabled and you Disable the rotation policy at key creation time, the policy is still written to your key in a Disabled state. If you want to enable this policy later, you can do so.
Why do I see a privacy warning? 

The certificates issued by CIS cover the root domain (example.com) and one level of subdomain (.example.com).

  What’s happening 

A privacy warning appears in your browser if your new certificate has not yet been issued.

  Why it’s happening 

If you’re trying to reach a second-level subdomain (..example.com) a privacy warning appears in your browser, because these host names are not added to the SAN.

  How to fix it 

Allow up to 15 minutes for one of our partner Certificates Authorities (CAs) to issue a new certificate.
See [Enabling EU and HIPAA supported settings](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedeu-hipaa-supported) for more information.

There are several scenarios where you must use extra care to protect personal health information (PHI) in Discovery:



* Avoid importing any files that contain PHI from external data sources, such as Box, SharePoint, Salesforce, Web Crawl, IBM Cloud Object Storage. Avoid importing files with PHI from external data sources because data in transit between the source and the service cannot be isolated. See [Data source connection and data isolation](https://cloud.ibm.com/docs/discovery?topic=discovery-sourcessource_isolation).
* Avoid using PHI in your custom configuration files. See the [API reference](https://cloud.ibm.com/apidocs/discoveryadd-configuration).
* Queries are logged. If you anticipate that PHI might be used in a query, opt out of query logging. See [Usage monitoring](https://cloud.ibm.com/docs/discovery?topic=discovery-usage).
* If you are specifying your own document_ids using the API, avoid using a file name as the document_id. See [Add a document](https://cloud.ibm.com/apidocs/discoveryadd-a-document) for instructions to specify your own document_id.
* Avoid using PHI in your IBM Watson™ Knowledge Studio models. See [Integrating with Knowledge Studio](https://cloud.ibm.com/docs/discovery?topic=discovery-integrating-with-wks).
For more information, see the topic on [User data](https://cloud.ibm.com/docs/vpc?topic=vpc-user-data).

The metadata that you access from within the instance is not protected by any encryption method. Any user with access to the instance and metadata service can potentially see the metadata. As a precaution, do not store sensitive data, such as passwords or customer encryption keys, as user data.









 Scenarios for using the metadata service 

You can use the metadata service in two ways:



* Access the metadata from within the instance.

In this scenario, you retrieve metadata from within the instance to bootstrap the instance. For example, you might want to specify custom user data when you create the instance and then, retrieve that custom user data when the instance is initialized. For more information, see [Accessing metadata from an instance](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-access-instance-metadata).
* Access an instance identity IAM token and call IAM-enabled services.

In this scenario, you create a trusted profile for a compute resource identity and assign access rights for IAM-enabled services to a virtual server instance. Make a call to create a new instance, which is configured with the metadata service, then link the instance to the trusted profile. Call the metadata service to get an instance identity access token, then [generate an IAM token](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-configure-service&interface=apiimd-token-exchange) from that token. You can then call IAM-enabled services from the instance. Use this option when you want to call IAM-enabled services as part of instance bootstrapping. For example, you might want to set up a new Object Storage bucket to be used by the instance workload. For more information, see [Using a trusted profile to call IAM-enabled services](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-trusted-profile-metadata).



Figure 1 illustrates these scenarios.

Zoom

!
Security and Compliance 



 Protection Against Unauthorized Access 

IBM Cloud® Databases for PostgreSQL use the following methods to protect data in transit or in storage.



* All Databases for PostgreSQL connections use TLS/SSL encryption for data in transit. The current supported version of this encryption is TLS 1.2.
* Access to the Account, Management Console UI, and API is secured via [Identity and Access Management (IAM)](https://cloud.ibm.com/docs/databases-for-postgresql?topic=cloud-databases-iam).
* Access to the database is secured through the standard access controls provided by the database. These access controls are configured to require valid database-level credentials that are obtainable only through prior access to the database or through our Management Console UI or API.
* All Databases for PostgreSQL storage is provided on storage encrypted with LUKS using AES-256. The default keys are managed by [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about). Bring-your-own-key (BYOK) for encryption is also available through [Key Protect Integration](https://cloud.ibm.com/docs/databases-for-postgresql?topic=cloud-databases-key-protect).
* IP allowlisting - All deployments support [allowlisting IP addresses](https://cloud.ibm.com/docs/databases-for-postgresql?topic=cloud-databases-allowlisting) to restrict access to the service.
* Public and Private Networking - Databases for PostgreSQL is integrated with [Service Endpoints](https://cloud.ibm.com/docs/databases-for-postgresql?topic=cloud-databases-service-endpoints). You can select whether to use connections over the public network, the IBM Cloud internal network, or both.
* Dedicated Cores - Allocating dedicated cores to your deployment introduces hypervisor-level isolation to your database instance, using isolated virtual machines to ensure that your data processing remains separated from other customers.
How secure is the metadata service? Are their additional security measures I need to take? 

Metadata is retrieved only from the instance to which you have access. Data common to multiple instances is retrieved but specific IP addresses of other instances are not exposed. Further, calls to the metadata service are secure prior to leaving the compute host from which they originate. While access is over HTTP, data is wrapped into a secure protocol prior to leaving the compute host. For more information, see this section on [data security](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-aboutimd-security) and these additional [security best practices](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-security-best-practices).





 What is a compute resource identity and how does it relate to the metadata service? 

Compute resource identities assign an IBM Cloud IAM identity to an individual compute resource. Instead of having to create a service ID, generate an API key, get the application to store and validate that key, you can assign IAM identity directly to the instance and acquire access tokens.





 What is a trusted profile? 

A trusted profile is an IAM object created by the compute resource identity service, against which you assign access rights to enable the instance to call IAM-enabled service. You can use a trusted profile when accessing the instance metadata service. For more information, see [Using a trusted profile to call IAM-enabled services](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-trusted-profile-metadata).
It is recommended that you use a protected connection if you use the public route, for example, a VPN.
* Public IP addresses are mapped to internal IP addresses on all ports. Make sure you open only the ports on your virtual server that you want to be exposed to the public network.
* Use the internal IP address to connect from one virtual server to another in the same region via the internal network. Your traffic on the internal network is automatically isolated from other tenants.







 Deleting Hyper Protect Virtual Servers instances 

Use the [web user interface](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-remove_vs) or the [CLI](https://cloud.ibm.com/docs/hpvs-cli-pluginhpvs-instance-delete) to delete your instance. The virtual server and all the data that is stored in it is deleted after the 7-day reclamation period, as described [here](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-remove_vs).

The Hyper Protect Virtual Servers data retention policy describes how long your data is stored after you delete the service. The data retention policy is included in the IBM Cloud Hyper Protect Virtual Servers service description, which you can find in the [Terms and Notices](https://www-03.ibm.com/software/sla/sladb.nsf/sla/bm-8680-01).