Both SLASCONE's licensing and analytics module require your software to communicate over the internet with the SLASCONE API and transmit installation, licensing and analytical data.

In addition to that, if you decide to give your end customers access to SLASCONE's customer portal, they need to register to the application.

This naturally raises legal considerations about data privacy. This article gives general data privacy guidelines concerning your software's connection to SLASCONE, especially in the context of GDPR. It is by no means a legally binding document. Such a document depends on the laws of your operating country and those of your end-customers.

GDPR COMPLIANCE

SLASCONE consists of two independent modules:

• SLASCONE licensing is a GDPR-compliant solution.
• SLASCONE analytics can be operated in a GDPR-compliant way.

As highlighted in the rest of this document, there are two SLASCONE areas that need extra attention in terms of GDPR:

• Access to the customer portal
• Analytics

DATA RESIDENCY

SLASCONE is a modern, cloud native application, enabling you to choose the residency of your data, based on Microsoft Azure's availability zones:

https://docs.microsoft.com/en-us/azure/availability-zones/az-overview

Data residency compliance with GDPR is thus guaranteed for European providers.

ALL SLASCONE components run in Microsoft Azure. This document guides you to information to help you honor rights and fulfill obligations under the GDPR when using Microsoft products and services.

ENCRYPTION

TRANSMITTED DATA

All data is transmitted to the SLASCONE API in encrypted form, enforcing TLS (1.2) and HTTPS. This is standard technology for keeping an internet connection secure and safeguarding any sensitive data that is being sent between two systems, preventing criminals from reading and modifying any information transferred, including potential personal details.

SAVED DATA

All data handled by the SLASCONE application is saved in one of the following Microsoft Azure technologies:

AZURE SQL DATABASE

Transparent data encryption (TDE) helps protect Azure SQL Database against the threat of malicious activity by encrypting data at rest. It performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application.

SLASCONE data and backups are encrypted.

AZURE STORAGE

Azure Storage uses service-side encryption (SSE) to automatically encrypt data when it is persisted to the cloud. More details can be found here.

AZURE AD B2C

Azure AD B2C complies with the security, privacy, and other commitments described in the Microsoft Azure Trust Center.

Sessions are modeled as encrypted data, with the decryption key known only to the Azure AD B2C Security Token Service. A strong encryption algorithm, AES-192, is used. All communication paths are protected with TLS for confidentiality and integrity. The Security Token Service uses an Extended Validation (EV) certificate for TLS. In general, the Security Token Service mitigates cross-site scripting (XSS) attacks by not rendering untrusted input.

More details can be found here.

PERSISTENT DATA

IDENTITY MANAGEMENT

SLASCONE uses Azure AD B2C as its internal identity provider, for all 3 web portals:

• Vendor Portal
• Reseller Portal
• Customer Portal

AD B2C does not require any personal information other than the email address (for obvious log in purposes). AD B2C is a modern, secure identity solution, that can be employed in a GDPR-compliant way.

In terms of data privacy, the Reseller and Customer portal present more challenges, since they involve customer data. Read more about AD B2C GDPR compliance here.

SLASCONE LICENSING

SLASCONE licensing uses an Azure SQL Database as its internal storage. SLASCONE licensing does not permanently save any personal or unrelated to licensing data.

SLASCONE ANALYTICS

SLASCONE analytics uses an Azure SQL Database as its internal storage. More about its compliance can be found in the remainder of this document.

LICENSING - ACTIVATION

DEVICE BASED SCENARIOS

As a vendor, you have the right to enforce a license activation or validation over the internet (without allowing an opt-out).  You just have to make sure that the process is clearly described in your Terms of Services or End User License Agreement.

Here is a sample formulation:

When you activate <YourProduct>, a specific product key is associated with the device on which your software is installed. The product key (and data about the software version and operating system of your device) is sent to <YourCompany> to help validate your license to the software. This data may be sent again if there is a need to re-activate or validate your license, or to validate your session (in floating license scenarios).

USER BASED SCENARIOS

If you have a user based scenario, you have to make sure that your identity provider, which obviously contains personal data, conforms to the laws of your operating country.

• If your application (not SLASCONE) uses AD B2C, read here.
• If your application uses any other identity provider, please refer to its documentation.

All known identity providers such as AD B2C, Okta, Keycloak can be operated in a GDPR-compliant way.

ANALYTICS - TELEMETRY

While online licensing and activation are almost industry standards, data privacy gets more complicated when collecting usage (analytic) data, also commonly known as telemetry data.

GENERAL CONSIDERATIONS

The collection of telemetry data can raise at least three relevant concerns for users of that software, as described here:

1. Individual data privacy: Does the telemetry data lead to the ability to track or uniquely identify the user? Even if it doesn’t, does the telemetry data otherwise include some form of personal information that is subject to laws and regulations, or even just that the user doesn’t realize is being shared?
2. Awareness of collection: Does the software ensure that all relevant users and installers of the software are aware of the telemetry data collection, before it is enabled? Is it opt-out or opt-in? Can notices or consents be inadvertently bypassed when the software is installed through automated means?
3. Security of collection mechanism: Does the connection to an external API open up any inadvertent security vulnerabilities? Could those vulnerabilities be present even for users who refuse to enable telemetry data?

SLASCONE CONSIDERATIONS

SLASCONE's (usage) analytics functionality is generic, which means that you as a vendor can collect any data you want from your installations. In other words, SLASCONE can be seen as a database. Therefore, it is your responsibility as a vendor to make sure that the collected data comply with data privacy regulations.

However, usage analytics are typically used to collect data about the usage of specific product features and modules. Here is a sample formulation for such a scenario:

When you use <YourProduct>, activity data such as when a session started on a device, how long it run and which product features were used or how often they were used, may be collected.

DATA GRANULARITY

All analytical data collected through the API is associated with a specific license token, i.e., the license token is the lowest granularity level. Based on that, data can be analyzed in aggregated form (e.g., license, customer). Please note that depending on your application (B2B/B2C, web/desktop/mobile) this may enable the unique identification of a user.

OPT OUT MECHANISM

In any case, it is recommended to ensure that your end-customers can opt out of telemetry data.