How we keep customer data secure.

To help prevent the unintended collection of PII, as well as passwords, PCI, PHI & other sensitive data through our products, we offer several implementation tools, including out-of-the-box PCI/SPI exclusions, as noted above. For certain use cases, where there is a specific business need to capture and process basic PII, we require customers to use our public/private key encryption. This feature fully encrypts any user input fields that have not been blocked, and any displayed data that has been marked for encryption within the end user’s browser or app – with several layers of military-grade encryption – before it ever touches the Internet, and subsequently stored on our platform. The data is always end-to-end encrypted, and only you, as the customer, have the ability to decrypt that data using your unique private key.

Moreover, we take a layered and automated approach to all data capture, one that continuously monitors raw data being ingested into our system. As such, the stringent security controls noted above, are further enforced, with our cutting edge AutoPII functionality. AutoPII proactively scans data, and applies advanced Data Loss Prevention (DLP) algorithms to detect possible occurrences of accidental PII as well as PCI/PHI/SPI that might have come across the wire (for instance, due to changes on the customer’s website or native app). You can think of this feature as a form of ‘PII Loss Prevention’ for your subscription.

Once web & native app session replay data has been ingested into the Quantum Metric platform, the AutoPIl process begins, by first periodically selecting a random set of sessions for further analysis (note: our current DLP looks for sample sessions where there is likely a lot of interaction between the user and the site, in particular those containing checkout flows that have conversions).

Next, the Cloud DLP scanning & analysis process is used to locate any potential PIl that may be found within the actual replay files. The scanner loads up the sample replay files, identifies where on the page an occurrence of PIl data may be located, and then classifies the suspected hit (by providing necessary context e.g. a CSS selector for the element on the page, API path etc, depending on where exactly the PIl was located in the replay).

Finally, the results of the replay scanning phase are aggregated into high level findings, and can subsequently be reviewed right from within the Quantum Metric user interface.

The Quantum Metric user interface provides the ability to view the session replay in question by providing a replay link that points to the start of the page hit where PII was detected, mask the detected PII directly, or ignore the result for future scans (in the case of false positives).

So by either fully blocking, or encrypting PII before it ever leaves any end user’s device, as well as proactively detecting any outlier PII data that may have been inadvertently captured, Quantum Metric works to ensure that unintended/unencrypted PII/PCI/SPI/PHI is flagged, allowing you to block the data from being captured in the future and/or request it to be purged from the platform.