Data Residency
The inherent business advantages of cloud computing are making organizations worldwide seriously consider migrating applications and data into the cloud. Unfortunately, there exist dozens of laws that govern the flow and storage of data across national borders, including legislation governing privacy law, intellectual property law, law enforcement regulations, e-discovery obligations and intelligence gathering regulations. For instance:
- In Nova Scotia and British Columbia, most personal data held by public bodies cannot be moved outside the borders of Canada.
- Australia’s National Privacy Principle #9, concerning trans-border data flows, prohibits the transfer of personal information to a foreign country unless certain criteria are met, including the condition that the foreign country upholds law substantially similar to the National Privacy Principles.
- Likewise, the EU Data Protection Directive broadly restricts the flow of personal information from within Europe to any country whose domestic laws do not provide an “adequate level of protection”.
While the US Dept. of Commerce has organized a voluntary mechanism for US companies to certify compliance with this EU directive (the US-EU Safe Harbor Principles), the sufficiency of these mechanisms has been the subject of regular criticism. In April 2010, German data protection authorities issued a resolution requiring extra diligence for German data exporters interacting with US Safe Harbor-certified entities—effectively calling into question the sufficiency of the Safe Harbor program to meet EU guidelines—holding exporters liable for lack of diligence, to face possible sanctions. Other nations have expressed reservations about data stored in US-based clouds falling under the jurisdiction of US laws like the Patriot Act.
Data Residency Laws’ Impact on Cloud Computing
One common question that often comes up during cloud computing discussions is, “where is my data stored?” Data sovereignty raises issues for businesses adopting cloud computing for sensitive data.
Cloud service providers often store customer data in various geographical locations to ensure scalability, efficiency and resiliency. Your data may not reside within the same country as your business, and privacy laws vary dramatically between countries and regions.
When moving applications to the cloud, you want to understand not only where your users reside, but also where the data resides in the cloud application – if not precisely, at least in which legal jurisdictions. Yet this information can be difficult to determine, as data is constantly in motion in the cloud.
Tokenization & Data Residency
Tokenization is the process of substituting original (sensitive) data with randomly generated alphanumeric values (tokens). While structurally similar to the original data, these tokens have no mathematic relationship with the original data. The mapping between the original data and tokens is stored in a secure token database, and access to this database is required to reverse the process and retrieve the original data.
By retaining original data within the concerned jurisdiction and storing tokens in cloud applications, data residency challenges can be eliminated.
CipherCloud Tokenization Eliminates Cloud Data Residency Challenges
CipherCloud’s patent-pending tokenization technology allows customers to replace sensitive information with anonymous values (tokens) that respect field formatting, and preserve all native features and functionality of compatible cloud solutions, such as searching, sorting, and reporting. The token database that stores sensitive information can either be placed behind the enterprise firewall or with a trusted hosting provider in the customers’ jurisdiction. Additional key characteristics include:
- Rapid configuration and deployment
- High-performance architecture with ultra-low latency
- Support for multiple load-balancing and high-availability deployment topologies to address global customer needs
- Subscription based pricing that eliminates up-front capital expenditure
- Centralized logging and auditing of user activities in the cloud
- Extensible architecture for cross-platform tokenization
Conclusion
With CipherCloud, you can migrate your data and applications to the cloud while ensuring compliance with all data residency and sovereignty requirements:
- Satisfy data residency requirements and independently manage compliance
- Eliminate the risk of foreign jurisdiction being applicable to your sensitive data (e.g. U.S. Patriot Act)
- Avoid consequences of privacy breaches and breach notification laws
- Accelerate cloud adoption and value realization