vania-janet/multiturn-rag-retrieval-data huggingface dataset:
One or more unique, human-readable aliases assigned to your key.<br><br>Important: To protect your privacy, do not store your personal data as metadata for your key.<br><br>Each alias must be alphanumeric, case-sensitive, and cannot contain spaces or special characters other than dashes (-) or underscores (_). The alias cannot be a version 4 UUID and must not be a Hyper Protect Crypto Services reserved name: allowed_ip, key, keys, metadata, policy, policies, registration, registrations, ring, rings, rotate, wrap, unwrap, rewrap, version, versions. Alias size can be 2 - 90 characters (inclusive). 
 key_description Optional: An extended description of your key.<br><br>Important: To protect your privacy, do not store your personal data as metadata for your key. 
 YYYY-MM-DD<br><br>HH:MM:SS.SS Optional: The date and time that the key expires in the system, in RFC 3339 format. If the expirationDate attribute is omitted, the key does not expire. 
 key_type A boolean value that determines whether the key material can leave the service.<br><br>When you set the extractable attribute to true, the service creates a standard key that you can store in your apps or services. 



To protect the confidentiality of your personal data, avoid entering personally identifiable information (PII), such as your name or location, when you add keys to the service. For more examples of PII, see section 2.2 of the [NIST Special Publication 800-122](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf).

A successful POST /v2/keys response returns the ID value for your key, along with other metadata. The ID is a unique identifier that is assigned to your key and is used for subsequent calls to the Hyper Protect Crypto Services key management service API.
3. Optional: Verify that the key was created by running the following call to get the keys in your Hyper Protect Crypto Services service instance.
A root key can be generated or imported, and managed by you in your Key Protect instance (for example, by rotating keys).

Key Protect can generate DEKs (which wraps keys without passing plaintext) through its HSM.
* What is envelope encryption?

Envelope encryption is the practice of encrypting data with a data encryption key, and then encrypting the data encryption key with a highly secure key-wrapping key. Your data is protected at rest by applying multiple layers of encryption. To learn more about envelope encryption check out [Protecting data with envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).
* How long can a key name be?

You can use a key name that is up to 90 characters in length.
* Can I store personal information as metadata for my keys?

To protect the confidentiality of your personal data, do not store personally identifiable information (PII) as metadata for your keys. Personal information includes your name, address, phone number, email address, or other information that might identify, contact, or locate you, your customers, or anyone else.

You are responsible for ensuring the security of any information that you store as metadata for Key Protect resources and encryption keys.

For more examples of personal data, see section 2.2 of the [NIST Special Publication 800-122](https://www.nist.gov/publications/guide-protecting-confidentiality-personally-identifiable-information-pii).
* Can encryption keys that are created in one region be used in another region?

Your encryption keys can be used to encrypt data stores located anywhere within IBM Cloud.
* How do I control who has access to keys?

Key Protect supports a centralized access control system, governed by IBM Cloud® Identity and Access Management, to help you manage users and access for your encryption keys and allow the principle of least privilege.
[External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/icons/launch-glyph.svg)]( [http://www.ibm.com/gdpr](http://www.ibm.com/gdpr)){: new_window}.





 Labeling and deleting data in Natural Language Understanding 

Users should not input any sensitive or personal information when using customization features. Beta releases may not be compatible with legislation such as GDPR.

The Natural Language Understanding service processes but does not store users’ data. Users of the Natural Language Understanding service do not need to take any action to identify, protect, or delete their data.
Data on a file share is encrypted at rest with IBM-managed encryption by default. For added security, you can use your own root keys to protect your file shares with customer-managed keys. When you specify the security group access mode and attach a [virtual network interface](https://cloud.ibm.com/docs/vpc?topic=vpc-vni-about) to the file share mount target, you can enable encryption of data in transit. For more information, see [File share encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-aboutFS-encryption).

You can apply user tags and access management tags to your file shares. Add tags when you create a share or update an existing share with the UI, CLI, API, or Terraform. For more information, see [Tags for file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-aboutfs-about-fs-tags).

You can enable context-based restrictions (CBR) for all file share operations. These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure, such as creating a file share. For more information, see [Protecting Virtual Private Cloud (VPC) Infrastructure Services with context-based restrictions](https://cloud.ibm.com/docs/vpc?topic=vpc-cbr).

File Storage for VPC is integrated with the Security and Compliance Center to help you manage security and compliance for your organization. For more information, see [Managing security and compliance](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managingfs-vpc-manage-security).
General Data Protection Regulation (GDPR) 

The GDPR seeks to create a harmonized data protection law framework across the EU. It aims to give citizens back the control of their personal data, while it imposes strict rules on the ones who host and "process" this data, anywhere in the world. The Regulation also introduces rules that relate to the free movement of personal data within and outside the EU.

With the [General Data Protection Regulation](https://gdpr.eu/), IBM® Cloudant® for IBM Cloud® customers can rely on the IBM Cloudant team's understanding and compliance with emerging data privacy standards and legislation. Customers can also rely on IBM's wider ability to provide a comprehensive suite of solutions to assist businesses of all sizes with their own internal data governance requirements.



 How do I audit access to IBM Cloudant? 

You can find information about auditing in [Audit logging](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-audit-loggingaudit-logging).





 Supported classifications of Personal Data 

The following categories of Personal Data are supported by IBM Cloudant for GDPR:



* Identity and civil status
* Personal life
* Professional life
* Location data
* Connectivity and device data



Sensitive Personal Data is restricted to the following category:



* Health data, extra conditions apply to be covered in the [IBM Cloudant Dedicated Cluster Service Description](https://www-03.ibm.com/software/sla/sladb.nsf/pdf/6756-04/$file/i126-6756-04_05-2018_en_US.pdf) and [IBM Cloud® Additional Service Description](https://www-03.ibm.com/software/sla/sladb.nsf/sla/saas?OpenDocument).



If you're storing healthcare data, you must complete the following tasks:



* Notify IBM Cloudant before you write any data.
* Request a HIPAA-compliant Dedicated Cluster.



For more information about supported classifications of Personal Data, see the [Data Sheet Addendum (DSA) under 2.
This step adds another level of security.

Another alternative is to use allow rules to define access to particular users or groups. Allow rules require you to decide what software needs access to instance metadata. By defining rules, you can prevent software from accidentally accessing the metadata service if you later change the software or configuration on the instance.

You can also define group usage of the allow rules. Add and remove users from a permitted group without changing the firewall rule.

The following example prevents access to the instance metadata service by all processes, except for processes that are running in the user account trustworthy-user:

sudo iptables --append OUTPUT --proto tcp --destination 169.254.169.254 --match owner ! --uid-owner trustworthy-user --jump REJECT





 Limit trusted profiles for compute resource identities 

Limit trusted profiles that you create for compute resource identities. Optionally, don't assign a compute resource identity to an instance.

When you [remove trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trusted-profile-remove), compute resources and federated users are unlinked from the profile, and can no longer apply the trusted profile identity.

You can also update existing trusted profiles by redefining the trust relationship, assigning access policies, and updating session limits. For more information, see [Updating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trusted-profile-update).





 Additional network security measures 

Consider the following options for controlling network traffic to your virtual server instances:



* Restrict access to your instances by using [security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-the-security-group).
* Set up [access control lists](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls)(ACL) to control all incoming and outgoing traffic in IBM Cloud® Virtual Private Cloud. An ACL is a built-in, virtual firewall, similar to a security group.
Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_d0177bb7-8fda-44f5-ae1c-56f27cbf70b5_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30_nwd_1_tl_About_20HTTPS_20_7C_20IBM_20Cloud_20Docs_p_https_3A_2F_2Fcloud.ibm.com_2Fdocs_2FCDN_3Ftopic_3DCDN-about-https_r_lt_617_evt_pageLoad_sv_1_rn_393879](https://bat.bing.com/action/0?ti=146001191&Ver=2&mid=d0177bb7-8fda-44f5-ae1c-56f27cbf70b5&sid=cca51480229211eeac887b94c5a6c542&vid=cca50460229211ee874f7dc32b9b9a8d&vids=0&msclkid=N&pi=918639831&lg=en-US&sw=3840&sh=2160&sc=30&nwd=1&tl=About%20HTTPS%20%7C%20IBM%20Cloud%20Docs&p=https%3A%2F%2Fcloud.ibm.com%2Fdocs%2FCDN%3Ftopic%3DCDN-about-https&r=&lt=617&evt=pageLoad&sv=1&rn=393879)
Once data is removed from the private data collection, the hash on the channel can no longer be used to verify the transaction that created it. In the example network in Figure 3, Org C and Org D can use a block to live policy to ensure that any data that does not need to persist forever is removed from the network entirely within a specified time period.





 Option two: Private data collections on a separate channel 

Org C and Org D can also use private data collections in the context of a separate channel to provide additional isolation for their data. Creating a new channel, Channel Y in this case, ensures that the hash of the private data is only shared with the ordering service, without being shared with other members of the consortium and stored on their peers.

Zoom

![Using private data with a separate channel](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/data_res_private_data_channel.svg)

Figure 4. Org C and Org D form a separate channel, Channel Y, and use a private data collection. Hashes of data in the collection are stored on ledger Y, and is only stored by the peers in Germany but not on the peers in the United States.

In Figure 4, Org C and Org D have formed a new channel, Channel Y, that does not contain any members in the United States. As a result, hashes of data in the OrgC-OrgD collection is stored on ledger Y instead of ledger X, and is not stored on the peers in the United States. Because the ordering service is located in the United States, a hash of the data that is created in Germany still leaves the country.

Creating a separate channel can prevent transaction details from being shared with other organizations in the consortium. If the organizations in Germany used a shared channel, Org A and Org B would be able to see the number of transaction hashes that are committed to the channel ledger by the private data collection. This might provide those organizations visibility into the fact that Orgs C and D are transacting and the volume of transactions that are generated between them.
General Data Protection Regulation (GDPR) 

The GDPR seeks to create a harmonized data protection law framework across the EU. It aims to give citizens back the control of their personal data, while it imposes strict rules on the host and process the data, anywhere in the world. The Regulation also introduces rules that relate to the movement of personal data within and outside the EU.

With the [General Data Protection Regulation](https://gdpr.eu/), Schematics clients can rely on the Schematics team's understanding and compliance with emerging data privacy standards and legislation. Clients can also rely on IBM's wider ability to provide a comprehensive suite of solutions to assist businesses of all sizes with their own internal data governance requirements.



 How do you audit access to Schematics? 

You can find information about auditing in [Audit logging](https://cloud.ibm.com/docs/schematics?topic=schematics-at_events) and [managing user access](https://cloud.ibm.com/docs/schematics?topic=schematics-accessaccess-roles).





 Supporting classifications of personal data 

The following categories of personal data are supported by Schematics for GDPR:



* Basic contact information, such as email address, name, which is a subset of basic personal information.
* Technically identifiable personal information, such as authentication credentials, IP address.



For more information about data security in Schematics, see [Securing your data in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-data).





 About user data 

Schematics records few data about its users, which is limited to basic contact information such as email address, and name. Schematics is a data processor for said Personal Information (PI) data. Schematics processes the limited client PI in the course of running the service and optimizing the user experience. Schematics uses email for contacting clients. Monitoring client interactions with Schematics is another way Schematics processes PI.

Do not enter sensitive data for Schematics.
A secrets manager service can securely store these credentials, along with other types of secrets, in a centralized way for her to be able to access or maybe other services to access, like we'll see in a second. But when it's done, it's given her the peace of mind that her user credentials are securely stored and now she can worry about authenticating with the service and getting her job done because secrets manager is going to take care of that for her.

However, what's really important for secrets manager service to do is interact with the cloud service provider's IAM, or identity and access management service. IAM is going to be the source of truth allowing secrets manager to one, authenticate who she is so that it can pass it down to GitHub, and secondarily also allow for her to get the correct set of roles based on the paradigm that they have within their IAM service. With this, we now understand what it's like for a user to get the correct permission and be able to access the tool of their choice of their service, and be able to do this in the context of using a secrets manager service.

But now, let's look what it's like for a service to interact with another service and potentially where data breaches could be harmful.

Let's look at our service to service example. What we have to start with is a lending application. This lending app is going to want to request permissions to be able to access – again, we were talking about a database earlier. Let's be a little bit more specific: this database that it needs to access is a given table within the database has necessary information to give to its model in order to be able to make a judgment on whether or not they want to provide a consumer alone. So we're going to call this a profile database. So within here, we have profile DB, and we know that the set of permissions that we want to grant are going to be read permissions for table A. So again, where are we going to store the secret that's ultimately going to give us access to give us access to authentication and ultimately to the set of permissions that we need here? So that's again going to be the secrets manager service provided, and that service needs to talk to Cloud IAM again.
See [IBM Cloud Docs: Enabling the HIPAA Supported setting](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedenabling-hipaa) for additional information.





 General Data Protection Regulation (GDPR) readiness 

Please visit [IBM's commitment to GDPR readiness](https://www.ibm.com/data-responsibility/gdpr/) page to learn about IBM’s GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey.



* [IBM Data Processing Addendum (DPA)](https://www.ibm.com/support/customer/csol/terms/?cat=dpa)







 Privacy shield 

IBM Cloud Object Storage is privacy shield certified. For more information please visit [IBM Privacy Shield Privacy Policy for Certified IBM Cloud Services](https://www.ibm.com/privacy/details/us/en/privacy_shield.html).
* Check whether App ID is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check that Schematics uses KYOK for Key management
* Check whether Block Storage for VPC is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Hyper Protect DBaaS for PostgreSQL is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Cloud Object Storage is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Virtual Servers for VPC data volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether data disks are encrypted with customer-managed keys







 NIST supplemental guidance 

Selection of cryptographic mechanisms is based on the need to protect the confidentiality and integrity of organizational information. The strength of mechanism is commensurate with the security category and/or classification of the information. This control enhancement applies to significant concentrations of digital media in organizational areas designated for media storage and also to limited quantities of media generally associated with information system components in operational environments (e.g., portable storage devices, mobile devices). Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). Organizations employing cryptographic mechanisms to protect information at rest also consider cryptographic key management solutions.
Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_18b93944-4c00-48e9-b08a-66b152a51105_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30_nwd_1_tl_
A root key can be generated or imported, and managed by you in your Key Protect instance (for example, by rotating keys).

Key Protect can generate DEKs (which wraps keys without passing plaintext) through its HSM.





 What is envelope encryption? 

Envelope encryption is the practice of encrypting data with a data encryption key, and then encrypting the data encryption key with a highly secure key-wrapping key. Your data is protected at rest by applying multiple layers of encryption. To learn more about envelope encryption check out [Protecting data with envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).





 How long can a key name be? 

You can use a key name that is up to 90 characters in length.





 Can I store personal information as metadata for my keys? 

To protect the confidentiality of your personal data, do not store personally identifiable information (PII) as metadata for your keys. Personal information includes your name, address, phone number, email address, or other information that might identify, contact, or locate you, your customers, or anyone else.

You are responsible for ensuring the security of any information that you store as metadata for Key Protect resources and encryption keys.

For more examples of personal data, see section 2.2 of the [NIST Special Publication 800-122](https://www.nist.gov/publications/guide-protecting-confidentiality-personally-identifiable-information-pii).





 Can encryption keys that are created in one region be used in another region? 

Your encryption keys can be used to encrypt data stores located anywhere within IBM Cloud.





 How do I control who has access to keys? 

Key Protect supports a centralized access control system, governed by IBM Cloud® Identity and Access Management, to help you manage users and access for your encryption keys and allow the principle of least privilege. If you are a security admin for your service, you can assign [IBM Cloud IAM roles that correspond to the specific Key Protect permissions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles) you want to grant to members of your team.