vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Acceptable values are public-and-private or private-only. 



A successful request returns an HTTP 204 No Content response, which indicates that your Key Protect instance now enforces a network access policy. API requests to the service are restricted to the policy you set.

This policy applies to Key Protect instances only. The network access policy does not apply to specific keys.

Optional: Verify that the network access policy was created by browsing the policies that are available for your Key Protect instance.

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/instance/policies?policy=allowedNetwork"   -H "accept: application/vnd.ibm.kms.policy+json"   -H "authorization: Bearer <IAM_token>"   -H "bluemix-instance: <instance_ID>"





 Disabling network access to your Key Protect instance with the console 

If you prefer to disable a network access policy on your instance by using a graphical interface, you can use the IBM Cloud console.

After creating a network access policy, complete the following steps to disable a network access policy:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. On the Instance policies page, use the Policies table to browse the policies in your Key Protect instance.
5. Click the ⋯ icon to open a list of options for the policy that you want to disable.
6. From the options menu, click Disable policy and confirm the policy was disabled in the updated Policies table.









 What's next 

These are API references to set and list instance policies.



* [Set instance policies](https://cloud.ibm.com/apidocs/key-protectputinstancepolicy)
* [List instance policies](https://cloud.ibm.com/apidocs/key-protectgetinstancepolicy)
AR-2 - Privacy Impact And Risk Assessment 



  Control requirements 

The organization:

AR-2 (a)
:   Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII).

AR-2 (b)
:   Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.
Your privacy choices

![0_ti_146001191_Ver_2_mid_91628333-84d7-4531-b8f2-721f8124ac01_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30_nwd_1_tl_HTTP_20headers_20_7C_20IBM_20Cloud_20Docs_p_https_3A_2F_2Fcloud.ibm.com_2Fdocs_2Fcloud-foundry-public_3Ftopic_3Dcloud-foundry-public-http-headers_r_lt_796_evt_pageLoad_sv_1_rn_196001](https://bat.bing.com/action/0?ti=146001191&Ver=2&mid=91628333-84d7-4531-b8f2-721f8124ac01&sid=cca51480229211eeac887b94c5a6c542&vid=cca50460229211ee874f7dc32b9b9a8d&vids=0&msclkid=N&pi=918639831&lg=en-US&sw=3840&sh=2160&sc=30&nwd=1&tl=HTTP%20headers%20%7C%20IBM%20Cloud%20Docs&p=https%3A%2F%2Fcloud.ibm.com%2Fdocs%2Fcloud-foundry-public%3Ftopic%3Dcloud-foundry-public-http-headers&r=&lt=796&evt=pageLoad&sv=1&rn=196001)
As multiple personas and legal entities collaborate, it’s essential to separate duty and access. Hyper Protect Virtual Servers for VPC is based on a newly introduced [encrypted contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_se) concept. It enables each persona to provide its contribution and be ensured through encryption that none of the other personas can access this data or intellectual property. The deployment can be validated by an auditor persona through an [attestation record](https://cloud.ibm.com/docs/vpc?topic=vpc-about-attestation), which is signed and encrypted to ensure only the auditor has this level of insight.
* Malware protections

Hyper Protect Virtual Servers for VPC leverages Secure Build to set up a verification process to ensure that only authorized code is running in an application. It deploys only container versions that are validated at deployment through explicit [digest or are signed](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_images) and may be pulled from a [private container registry with authentication](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_auths) only.
* Bring your own OCI image and leverage managed Container Runtime service

Use any [open-container initiative (OCI)](https://opencontainers.org/) image and gain the benefits of a confidential computing solution for extra levels of protection. Ensure through a [signed contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_sign), that only a given combination of your workload and environment is deployed.
* Built on the Virtual Private Cloud (VPC) infrastructure for extra network security

Choose from various profile sizes and grow as needed to protect containerized applications and pay-as-you-go on an hourly basis.
Privacy policy: Default Facebook and Google settings 

Effective: August 2019 Client, hereinafter referred to as "Developer", performs development and testing of applications by using the default configuration of IBM Cloud® App ID ("App ID" or "Service") for Facebook or Google. Developer uses the default settings of App ID only for evaluation and testing purposes, and to determine whether to incorporate App ID into the applications being developed by Developer ("Permitted Uses"). Developer will not use the default settings of App ID for any uses or purposes other than the previously stated Permitted Uses.

Developer will implement a Privacy Policy, separate from this document, upon transition of applications from development to production.

This document informs of: the policies regarding the collection, use, disclosure, or any other operations carried out ("Processing") on personally identifiable information that can be used to contact or identify a person ("Personal Data"); and Developer’s responsibilities when engaging in the Permitted Uses of the Service, and the choices associated with the Processing of Personal Data.

Developer will Process Personal Data while engaging in the Permitted Uses of the Service. By using the Service, Developer confirms that it is Processing Personal Data in accordance with this policy and applicable laws.



 Information Collection And Use 

Developer collects several different types of information for the Permitted Uses. The following types of data are collected and are described as follows: Personal Data, Usage Data, and Tracking and Cookies Data.



 Personal Data 

While engaging in the Permitted Uses of the Service, Developer may collect certain personally identifiable information that can be used to contact or identify a person ("Personal Data"). Personally identifiable information may include, but is not limited to:



* Cookies and Usage Data
* Basic Personal Information (such as name, address, phone number, email, and so on.)
* Technically Identifiable Personal Information (such as device IDs, usage-based identifiers, static IP address, and so on. - when linked to an individual)
* Healthcare Information (data related to physical or mental health of an individual, or which otherwise reveals information about his or her health status)







 Usage Data 

When engaging in the Permitted Uses of the Service, Developer may collect certain information automatically, including, but not limited to the following (collectively "Usage Data"):
Data on a file share is encrypted at rest with IBM-managed encryption by default. For added security, you can use your own root keys to protect your file shares with customer-managed keys. When you specify the security group access mode and attach a [virtual network interface](https://cloud.ibm.com/docs/vpc?topic=vpc-vni-about) to the file share mount target, you can enable encryption of data in transit. For more information, see [File share encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=uiFS-encryption).

You can apply user tags and access management tags to your file shares. Add tags when you create a share or update an existing share with the UI, CLI, API, or Terraform. For more information, see [Tags for file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=uifs-about-fs-tags).

You can enable context-based restrictions (CBR) for all file share operations. These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure, such as creating a file share. For more information, see [Protecting Virtual Private Cloud (VPC) Infrastructure Services with context-based restrictions](https://cloud.ibm.com/docs/vpc?topic=vpc-cbr).

File Storage for VPC is integrated with the Security and Compliance Center to help you manage security and compliance for your organization. For more information, see [Managing security and compliance](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managingfs-vpc-manage-security).
For more information about redirect URIs, see [Adding redirect URIs](https://cloud.ibm.com/docs/appid?topic=appid-managing-idpadd-redirect-uri).

Do not include any query parameters in your URL. They are ignored in the validation process. Example URL: http://host:[port]/path
* How does encryption work in App ID?

Check out the following table for answers to commonly asked questions about encryption.



Table 2. Frequently asked questions about how App ID handles encryption

 Question Answer 

 Why do you use encryption? One way that we protect our users' information is by encrypting customer data at rest and in transit. The service encrypts customer data at rest with per-tenant keys and enforces TLS 1.2+ in all network segments. 
 Which algorithms are used in App ID? The service uses AES and SHA-256 with salting. 
 Do you use public or open source encryption modules or providers? Do you ever expose encryption functions? The service uses avax.crypto Java libraries, but never exposes an encryption function. 
 How are keys stored? Keys are generated, encrypted with a master key that is specific to each region, and then stored locally. The master keys are stored in [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial). Each region has its own root-of-trust key that is stored in [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial), which is backed up by HSM. Each service instance (tenant) has its own data encryption and token signature keys, which are encrypted by using the region's root-of-key trust. 
 What is the key strength that you use? The service uses 16 bytes. 
 Do you invoke any remote APIs that expose encryption capabilities No, we do not. 



* What clock synchronization does App ID use?
Information security 

IBM is committed to providing our clients and partners with innovative data privacy, security and governance solutions.

Notice: Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that may affect the clients’ business and any actions the clients may need to take to comply with such laws and regulations.

The products, services, and other capabilities described herein are not suitable for all client situations and may have restricted availability. IBM does not provide legal, accounting or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation.

If you need to request GDPR support for IBM Cloud® Watson resources that are created



* In the European Union, see [Requesting support for IBM Cloud Watson resources created in the European Union](https://cloud.ibm.com/docs/watson?topic=watson-gdpr-sarrequest-EU).
* Outside the European Union, see [Requesting support for resources outside the European Union](https://cloud.ibm.com/docs/watson?topic=watson-gdpr-sarrequest-non-EU).





 European Union General Data Protection Regulation (GDPR) 

IBM is committed to providing our clients and partners with innovative data privacy, security and governance solutions to assist them on their journey to GDPR compliance.

Learn more about IBM's own GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey [here](http://www.ibm.com/gdpr).





 Health Insurance Portability and Accountability Act (HIPAA) 

US Health Insurance Portability and Accountability Act (HIPAA) support is available for Premium plans in the Washington, DC location created on or after 1 April 2019. See [Enabling EU and HIPAA supported settings](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedeu-hipaa-supported) for more information.





 GDPR in Knowledge Studio 

IBM Watson® Knowledge Studio provides a graphical interface through which you can access and delete uploaded artifacts that contain data. The following artifacts can be uploaded to Knowledge Studio:
The GDPR imposes strict rules on those hosting and processing personal data, anywhere in the world.

IBM is committed to providing our clients and IBM Business Partners with innovative data privacy, security, and governance solutions to assist them in their journey to GDPR readiness. Data and data protection are becoming increasingly important to individuals and society. Enterprises must earn the client’s trust in their ability to steward information.

IBM Cloud is agile and scalable with built-in data security, and privacy services and solutions that can be consumed on premises or through public cloud. Our comprehensive data security platform helps safeguard sensitive data wherever it resides and provides a full range of data protection capabilities.





 Environmental information 

IBM Cloud, as a user and as a provider, is environmentally conscious and strives to provide power efficiency and recycling in our data centers. As such, the servers that are put in service within the IBM Cloud comply with Commission Regulation (EU) 2019/424 of 15 March 2019 laying down ecodesign requirements for servers and data storage products (EU Lot 9).

For details, see the following data sheets on our physical hardware in the cloud:



* [Rack Mount Server 618U-TR4T+](https://cloud.ibm.com/media/docs/downloads/environment-info-datasheets/1U_X10DRU-i+.pdf)
* [Rack Mount Server 6019U-TN4R4T](https://cloud.ibm.com/media/docs/downloads/environment-info-datasheets/1U_X11DPU.pdf)
* [Rack Mount Server 5019C-WR-04](https://cloud.ibm.com/media/docs/downloads/environment-info-datasheets/1U_X11SCW.pdf)
* [Rack Mount Server 5019S-W4TR](https://cloud.ibm.com/media/docs/downloads/environment-info-datasheets/1U_X11SSW-4TF.pdf)
Securing your data 

Review what personal and sensitive information is stored when you use IBM Cloud Satellite®, how this data is stored and encrypted, and how you can permanently remove this information.



 What information is stored with IBM when using Satellite? 

For every location that you create, IBM stores certain personal and sensitive information. Depending on the type of information, IBM or you are responsible to store this information and protect it. For more information, see [How is my information stored, backed up, and encrypted?](https://cloud.ibm.com/docs/satellite?topic=satellite-data-securitysat-data-encryption).



 Stored information when you create a Satellite location 

The following information is stored when you create a Satellite location.

Personal information
: The email address of the IBM Cloud account that created the location.

Sensitive information
: 

* The TLS certificate and secret that is used for the assigned Satellite control plane domain.
* The Certificate Authority that is used for the TLS certificate.
* An IBM-owned encryption key for each location that is used to encrypt the TLS certificates, secrets, and Certificate Authority of the Satellite control plane domain.
* Satellite control plane and Satellite cluster data that can be used to restore the control plane and clusters in case of a disaster.







 Stored information from resources that you create in Satellite 

Because Satellite is an extension of IBM Cloud to your own environment, you create many resources whose metadata might be stored, backed up, and encrypted in Satellite.

Do not use sensitive or personally identifiable information for the names, labels, tags, or other metadata for the following items.



* Satellite resources, such as the names of locations, hosts, Satellite Link endpoints, Satellite configurations, versions, subscriptions, cluster group names, or storage configurations.
* [Satellite-enabled services](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services) resources, such as the names of service instances or clusters.
* Managed Kubernetes resources that run in clusters in your Satellite location, such as the names and resource definitions of deployments, pods, services, secrets, or config maps.
For more information, see [Introduction to encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-basics).

Data is automatically encrypted on the physical media at the drive level. However, customer-managed keys are not supported for instance storage. For sensitive data, it is strongly recommended that users utilize software-based file system encryption such as LUKS for Linux® or BitLocker for Windows®. This technology allows end users to encrypt entirely within the instance, and can provide additional protection for sensitive data in-transit between the instances and the physical drive media. Some operating systems also provide FIPS certified encryption algorithms that may also be used. See [Encrypting block devices using LUKS](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/encrypting-block-devices-using-luks_security-hardening) for an example of how to encrypt on Red Hat Enterprise Linux® however, refer to the Operating System documentation or specific information on how to encrypt each device.







 Protecting your sensitive data in VPC 

Key Protect or Hyper Protect Crypto Services provide a higher level of protection called envelope encryption.

[Envelope encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutvpc-envelope-ecryption-byok) encrypts one encryption key with another encryption key. A DEK encrypts your actual data. The DEK is never stored. Rather, it's encrypted by a key encryption key. The LUKS passphrase is then encrypted by a root key, which creates a WDEK. To decrypt data, the WDEK is unwrapped so you can access the data that's stored on the volume. This process is possible only by accessing the root key that is stored in your KMS instance. Root keys in HPCS service instances are also protected by a

hardware security module (HSM)master key.
SC-28 - Protection of Information at Rest 



 Control requirements 

SC-28 - 0
: The information system protects the [IBM Assignment: confidentiality AND integrity] of [IBM Assignment: data in all regions and availability zones].





 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Data encryption at rest](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether OS disks are encrypted with customer-managed keys
* Check whether App ID user data is encrypted
* Check whether Hyper Protect DBaaS for MongoDB is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether unattached disks are encrypted with customer-managed keys
* Check whether Virtual Servers for VPC boot volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Virtual Servers for VPC is provisioned from an encrypted image
* Check whether Event Streams is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether App ID is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check that Schematics uses KYOK for Key management
* Check whether Block Storage for VPC is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Hyper Protect DBaaS for PostgreSQL is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Cloud Object Storage is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Virtual Servers for VPC data volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether data disks are encrypted with customer-managed keys
Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_8f003ed6-6c50-456e-9052-528396c5d89e_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30_nwd_1_tl_HTTP_20concepts_20_7C_20IBM_20Cloud_20Docs_p_https_3A_2F_2Fcloud.ibm.com_2Fdocs_2Fcis_3Ftopic_3Dcis-http-concepts_r_lt_974_evt_pageLoad_sv_1_rn_666567](https://bat.bing.com/action/0?ti=146001191&Ver=2&mid=8f003ed6-6c50-456e-9052-528396c5d89e&sid=cca51480229211eeac887b94c5a6c542&vid=cca50460229211ee874f7dc32b9b9a8d&vids=0&msclkid=N&pi=918639831&lg=en-US&sw=3840&sh=2160&sc=30&nwd=1&tl=HTTP%20concepts%20%7C%20IBM%20Cloud%20Docs&p=https%3A%2F%2Fcloud.ibm.com%2Fdocs%2Fcis%3Ftopic%3Dcis-http-concepts&r=&lt=974&evt=pageLoad&sv=1&rn=666567)
Security and Compliance 



 Protection Against Unauthorized Access 

IBM Cloud® Databases for MySQL use the following methods to protect data in transit or in storage.



* All Databases for MySQL connections use TLS/SSL encryption for data in transit. The current supported version of this encryption is TLS 1.2.
* Access to the Account, Management Console UI, and API is secured through [Identity and Access Management (IAM)](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-iam).
* Access to the database is secured through the standard access controls provided by the database. These access controls are configured to require valid database-level credentials that are obtainable only through prior access to the database or through our Management Console UI or API.
* All Databases for MySQL storage is provided on storage encrypted with LUKS using AES-256. The default keys are managed by [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about). Bring-your-own-key (BYOK) for encryption is also available through [Key Protect Integration](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-key-protect).
* IP allowlisting - All deployments support [allowlisting IP addresses](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-allowlisting) to restrict access to the service.
* Public and Private Networking - Databases for MySQL is integrated with [Service Endpoints](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-service-endpoints). You can select whether to use connections over the public network, the IBM Cloud internal network, or both.
* Dedicated Cores - Allocating dedicated cores to your deployment introduces hypervisor-level isolation to your database instance, by using isolated virtual machines to ensure that your data processing remains separated from other customers. It also provides a minimum number of CPUs to your deployment.