diff --git a/README.md b/README.md index 0d65fdc..0ae76b6 100644 --- a/README.md +++ b/README.md @@ -6,11 +6,11 @@ [![Slack](https://img.shields.io/badge/slack-join%20chat%20%E2%86%92-e01563.svg)](https://join.slack.com/t/paranoidguy/shared_invite/enQtODc2OTE1NjYyODM1LTI0MmM2ZmYwZDI0MzExMjJmOGQyMTY4Y2UzOTQ0ZDIwOTZjMmRkZDZkY2I3MzE1OWE3ZWVmNTY4MjIwMzNhZTQ) -Project **demo** is available at: [https://demo.databunker.org/](https://demo.databunker.org/) . Please add a **star** if you like our project. +Project **demo** is available at: [https://demo.databunker.org/](https://demo.databunker.org/). Please add a **star** if you like our project. -We live in a world where our privacy of information is nonexistent, the EU has been working to remediate this fallacy with GDPR, and the US (California) follows with a first sparrow called CCPA. +We live in a world where the privacy of our information is nonexistent. The EU has been working to remediate this fallacy with GDPR, and the US (California) follows with a first sparrow called CCPA. -Data Bunker Project is intended to ease the acceptance of GDPR and CCPA regulations while giving organizations an easy to implement API's, secure Database to store PII and privacy portal. This will give all of us, the real data owners, control of our data, and allow us to know who is using our data, what is he doing with it and have the freedom to decide if we agree to that or not. +Data Bunker Project is intended to ease the acceptance of GDPR and CCPA regulations while giving organizations an easy to implement API's, secure Database to store PII, and privacy portal. This will give all of us, the real data owners, control of our data, and allow us to know who is using our data, what is he doing with it, and have the freedom to decide if we agree to that or not. This project, when deployed correctly, replaces all the customer's personal records (PII) scattered in the organization's different internal databases and log files with a single, randomly generated token managed by the Data Bunker service. @@ -54,14 +54,14 @@ Demo Admin access token: ```DEMO``` **NOTE**: Implementing this project does not make you fully compliant with GDPR requirements and you still need to consult with an attorney specializing in privacy. -**NOTE**: When we use the term "Customer" we mean the data of the end-user that his information is being stored, shared and deleted. +**NOTE**: When we use the term "Customer" we mean the data of the end-user that his information is being stored, shared, and deleted. ## Right of access -Data Bunker extracts **customer email**, **customer phone** values out of the customers' personal records granting -**passwordless** access for the customer into their Data bunker' personal account. -This is done by generating a random access key that Data Bunker sends to your customer by email or by SMS. -Your customer can login and can view all information collected and saved by Data Bunker in connection to his profile. +Databunker extracts **customer email**, **customer phone** values out of the customers' personal records granting +**passwordless** access for the customer into their Databunker personal account. +This is done by generating a random access key that Databunker sends to your customer by email or by SMS. +Your customer can login and view all the information collected and saved by Databunker in connection to his profile.

login form @@ -69,16 +69,17 @@ Your customer can login and can view all information collected and saved by Data verify login with code

-## Right to restrict processing / Right to object / Consent withdrawal +## Right to restrict processing / Consent withdrawal -Data Bunker can manages all the customer's consents. A customer can **Withdraw/restrict/object to a specific consent** in his personal account at Data Bunker, for example, to restrict or block email. Your backend site can work with Data Bunker using our API to add, or cancel -consents and a callback operation will be fired when a customer's action takes place. +Databunker can manage all of the customer's consents. A customer can **Withdraw consent/restrict processing** in his personal +account at Databunker. For example, to block newsletter service. Your backend site can work with Databunker using our API to add, +or cancel consents and a callback operation will be fired when a customer's action takes place. ![Consent management](images/ui-consent-management.png) ![Consent withdrawal](images/ui-consent-withdrawal.png) **NOTE**: Data bunker can call your backend script on a consent withdrawal (callback). You will have to handle these requests and remove -the customer records from other 3rd party processing companies. For example: web recording services, email gateways and etc... +the customer records from other 3rd party processing companies. For example: web recording services, email gateways, etc... ## Privacy by design @@ -86,7 +87,7 @@ This product, from the architecture level and down to code was built to comply w ## Transparency and Accountability principle -Any system or customer connecting to Data Bunker must provide an **access token** to authorize any operation, otherwise the operation will be aborted. An end customer can login to his profile with a random authorization code sent by email or SMS. +Any system or customer connecting to Databunker must provide an **access token** to authorize any operation, otherwise, the operation will be aborted. An end customer can login to his profile with a random authorization code sent by email or SMS. All operations with personal records are **saved in the audit log**. @@ -98,17 +99,17 @@ Any customer can log in to his account at Data Bunker and view the **full audit When your customer requests to exercise his **right to be forgotten**, his private records will be wiped out of the Data Bunker database, giving you the possibility to leave all internal databases intact while not impacting any of your other systems. -Upon customer removal request, Data bunker can call your backend script (callback) with the customer details. You will have to handle these requests and remove other customer records from 3rd party processing companies. For example from web recording services, email gateways and etc... +Upon customer removal request, Data bunker can call your backend script (callback) with the customer details. You will have to handle these requests and remove other customer records from 3rd party processing companies. For example from web recording services, email gateways, etc... ![Forget me](images/ui-forget-me.png) **NOTE**: You will need to make sure that you do not have any customer identifiable information (PII) in your other databases, -logs, files and etc. +logs, files, etc... ## Right to rectification/ Data Accuracy -Your customer can log in to his personal account at Data Bunker and change his records, for example **change his Name**. -Data Bunker can fire a callback operation with a customer details, when a customer action takes place. +Your customer can log in to his personal account at Data Bunker and change his records, for example, **change his Name**. +Databunker can fire a callback operation with customer's details when a customer action takes place. ![Change profile](images/ui-profile-edit-and-save.png) @@ -124,7 +125,7 @@ Your customer can log in to his personal account at Data Bunker and view and **e **All personal data is encrypted**. An audit log is written for all operations with personal records. All-access to Data Bunker API is done using an **HTTPS SSL certificate**. Enterprise version supports Shamir's Secret Sharing -algorithm to split the master key to a number of keys. A number of keys (that can be saved in different hands in the +algorithm to split the master key into a number of keys. A number of keys (that can be saved in different hands in the organization) are required to bring up the system. @@ -137,15 +138,15 @@ consult with an attorney specializing in privacy.** # Databunker use cases -Detailed information can be found at: https://databunker.org/use-case/ +Detailed information can be found at https://databunker.org/use-case/ * Personal information tokenization and storage * Critical data segregation * Trace customer profile changes and access -* GDPR compliant logging : Web and mobile app session data storage +* GDPR compliant logging: Web and mobile app session data storage * Temporary customer/app/session identity for 3rd party services * Data minimization and GDPR Scope reduction -* Consent management, i.e. withdawal +* Consent management, i.e. withdrawal * Simplify user login * GDPR user request workflow @@ -159,6 +160,6 @@ Follow this [article](https://databunker.org/doc/start/). # Contact us -For any questions, you can talk with us at: office@securitybunker.io +For any questions, you can talk with us at office@securitybunker.io Join the project slack channel to talk with developers: [https://paranoidguy.slack.com/](https://join.slack.com/t/paranoidguy/shared_invite/enQtODc2OTE1NjYyODM1LTI0MmM2ZmYwZDI0MzExMjJmOGQyMTY4Y2UzOTQ0ZDIwOTZjMmRkZDZkY2I3MzE1OWE3ZWVmNTY4MjIwMzNhZTQ)