Compliance with ArangoDB
If you are considering using ArangoDB as your native multi-model solution to store your sensitive data, rest assured that ArangoDB offers many solutions to meet your industry standards. The ArangoDB Enterprise Edition has the necessary measures set in place to ensure the privacy and security of your data, including Authentication, Authorization, Data Masking, Encryption 360°, and Auditing.
Safeguarding sensitive user data is of utmost importance today and is internationally enforced by regulators like the EU (GDPR) and United States (California’s CCPA), and a necessity for many companies to meet industry standards (Health Insurance Portability and Accountability Act – HIPAA; Payment Card Industry Data Security Standard – PCI).
Authentication establishes the identity of all users accessing the database. Each user attempting to enter the system must be appropriately identified to determine their role and ability to access the database. The ArangoDB LDAP Server feature available in ArangoDB Enterprise is the solution to this problem.
Once the user is authenticated in the LDAP server, ArangoDB offers two methods for authorization: (a) “roles attribute” and (b) “roles search”.
The data masking feature provides a convenient way to extract sensitive production data while masking critical information that should not be exposed. This includes names, birthdays, credit card numbers, addresses, emails or phone-numbers.
The Community Edition of ArangoDB already supports the masking function – random string, which masks data with an anonymized string of random length. The Enterprise Edition users have the option of taking this a step further with Enhanced Data Masking functions. The Enterprise Edition offers more masking types and more masking settings allowing to keep data structure when creating obfuscated data exports.
Encryption is a critical safeguard that ensures the security of the data and protects outside users from accessing data by monitoring traffic or intercepting data in transit. ArangoDB has you covered keeping your data encrypted at all times using three different methods: Encryption at Rest, Encryption in Transit, and Encrypted Backups.
GDPR and CCPA Compliance
Data protection should be a top priority for many applications today. Therefore, it is critical that your database has the features to help you reach full compliance for regional data processing regulations.
In 2018 the General Data Protection Regulation (GDPR) data privacy regulations were set into effect in the EU. Any organization inside or outside the EU must be GDPR compliant if they store, use, secure, or transmit EU resident’s personal data. California recently passed the California Consumer Privacy Act (CCPA) to regulate the collection, use and protection of personal data.
ArangoDB has you covered ensuring your applications built with ArangoDB maintains GDPR and CCPA compliance by meeting key privacy and security requirements. While the Community Edition provides some basics for compliance, the ArangoDB Enterprise Edition provides everything out-of-the-box. These additional security capabilities are what will ensure you can build full GDPR and CCPA compliant applications.
The Health Insurance Portability and Accountability Act (HIPAA) is a law passed in 1996 by US congress that sets standards and protocols for the protection of patient data in the healthcare industry. It states that personal patient data must be appropriately safeguarded and privacy sufficiently maintained.
ArangoDB provides all features necessary on the database side to be build full HIPAA-compliant applications.