Personally Identifiable Information (PII)

PII, also known as Personally Identifiable Information, refers to any data that is used to identify an individual, including sensitive information such as Names, Addresses, Social Security Numbers, Financial Information, Phone numbers, etc. Safeguarding PII is crucial to prevent unauthorized access and protect privacy.

Keep reading to know more about the different levels of security, and how WE handles this sensitive information.

What is Encryption and how does WE maintain and protect PII?

WE helps in maintaining and securing your user's information in mainly 3 ways, each of which have been discussed below.

1. WebEngage Encrypted Data or WebEngage Encryption

In this type of encryption, WebEngage will encrypt the data of your users as soon as it enters into our system.

a. Auto Hashing

Automated Hashing is a procedure wherein WebEngage automatically encrypts the email ID and phone number of a user as soon as it is introduced into our system. WebEngage does the segmentation, triggering, personalization as well as the last mile delivery. The decryption process occurs exclusively in real-time when transmitting data through campaigns to service providers.

Now that we know how auto hashing works in a broader sense, let's dig deeper and understand step by step from WE acquiring the data, storing the data and finally decrypting the data before sending it.

• While receiving data from the client, WE encrypts email and phone number, and stores the encrypted data in WE database, this ensures that the data is in encrypted form and data security is maintained.

While the data is in encrypted form, while at rest, WE makes sure that the data is decrypted right before sending the communication to the user.

Client Responsibility
Your responsibilities include:

• As our customer, you play a vital role in the process by providing personally identifiable information (PII) like Email ID, Phone number etc.

WebEngage’s Responsibilities

• WE assumes several critical responsibilities to ensure the security and effective utilization of data. Our platform prioritizes data safeguarding by employing an automated hashing mechanism to encrypt information.
• WE also maintains control over the encryption process and displays auto-hashed personally identifiable information (PII) on its dashboard, providing you with transparent access to your data.
• Most importantly, WebEngage takes responsibility till the last mile delivery and delivery reports of responses generated through the channel's process, emphasizing its dedication to effectively managing and safeguarding the entire data lifecycle.

b. PII Masking

While maintaining the data regarding User Attributes on your WE dashboard, we’ve made it possible for you to mask the actual values, by marking crucial data points as PII.
For attributes marked as PII,

1. Data is stored in the masked format.
2. The actual data can be viewed and downloaded only by account Admins who have the permission to View PII, and the values will remain hidden from not only the UI of your dashboards but also from downloads, reports etc. for all the other admins, who don’t have access.

You can mask or unmask a PII attribute anytime you’d like by selecting them as Mark as PII or Mark as Not PII respectively from the Actions menu adjacent to the attribute.

Client Responsibility

As our customer, you play a crucial responsibility by providing user data and can mask certain attribute values on your dashboards by marking them as PII. You can also unmask them at any time.

WebEngage's Responsibility

• WE restricts only account admins who have permission to ‘view PII’ will be able to see and download the actual values tracked against the marked custom user attribute. Values will remain hidden for all other users.
• WE will mask this PII attributes, and will restrict view to users who don't have access.

📘

Note

In our application, PII and non-PII fields are stored in a similar format within the underlying data storage system. This means that PII fields are not encrypted, and there is no transformation of data at rest. The primary differentiator is in how data is displayed to you when you access the dashboard.

2. Client Encrypted Data or Client Encryption

Client encryption (or Self Hashing), refers to the process where data is encrypted on the client i.e. your side. In this approach, you encrypt the data, the Personally Identifiable Information (PII), before passing it to WebEngage, ensuring confidentiality and security of sensitive data.

WebEngage receives, maintains and processes the data in the encrypted format. The WebEngage platform will never have access to the actual values and will always work with encrypted form of data.

Client Responsibility (Client Owned Middle Layer)

The client-owned Middle Layer assumes a critical role in this approach. As a client your key responsibilities include:

• Encrypting PII like Email IDs and Phone numbers and other attributes before transmitting it to WebEngage
• Managing the decryption Middle layer system. This middle layer is responsible for decrypting the data received from WebEngage, to use in campaigns.
• Integrating channel vendors, decrypting the PII before sending the communication to channel vendors.
• And handling responses/ status from Email, SMS, WhatsApp, etc. Know more here.

WebEngage’s Responsibility

• WebEngage's responsibility involves receiving encrypted personally identifiable information (PII) from the client and displaying the encrypted PII data on the dashboard.
• Additionally WebEngage also tracks the delivery status of the email that has been sent to your customers, i.e. tracking if the email was sent, queued, delivered, or opened etc. In the context of Webhook settings, you should set a URL on your side, this specific URL can be configured and accessed on the WebEngage dashboard within your ESP list.

• For client's side encryption, it is the clients responsibility to encrypt the data. The encrypted data is then sent to the WE system and data is in encrypted form in WE dashboard.

• WE shares the encrypted data for campaign to the clients middle layer, which then decrypts the data, and sends the decrypted information to the service provider.

For example, let’s consider an email campaign, here you need to encrypt your own data by building your own middleware or (encryption & decryption layer), at your end before sending us the encrypted data, this way your data will be encrypted on your WE dashboard. You can send this encrypted data to us through SDK, API, CSV, etc., which will then be stored in an encrypted format, and once the communication is done and the campaigns are ready to be sent, we send this encrypted data back to you where you decrypt this data using your middleware/ decryption layer, before sending to your respective ESP.

Service Provider or Vendor Responsibilities

Service Provider or vendor is responsible for delivering campaigns, including Email, SMS, and WhatsApp, by utilizing decrypted personally identifiable information (PII) data. This ensures targeted and effective campaign delivery.
Additionally, the Service Provider plays a key responsibility in relaying responses, such as Email opens, clicks, and bounces, back to the client, providing valuable insights into user interactions with campaign messages.

WebEngage's commitment to data security is evident in the implementation of various PII protection methods. Whether it's through encryption, role-based access control, or data hashing, WebEngage ensures that PII data is handled securely, reducing the risk of unauthorized access and data breaches.

Clients can be rest assured that their sensitive information remains protected while utilizing WebEngage's services to deliver personalized and targeted communications to their end-users.