You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/docs/guides/(authorization)/overview/modelling-hierarchy-with-attribute-types.mdx
+5-6Lines changed: 5 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,11 +1,12 @@
1
1
---
2
-
title: "Modeling Hierarchy with Attribute Scopes"
2
+
title: "Modeling hierarchy with attribute scopes"
3
3
slug: "modelling-hierarchy-with-attribute-types"
4
4
excerpt: ""
5
5
hidden: false
6
6
createdAt: "Thu Aug 03 2023 23:14:02 GMT+0000 (Coordinated Universal Time)"
7
7
updatedAt: "Fri Jun 21 2024 16:55:25 GMT+0000 (Coordinated Universal Time)"
8
8
---
9
+
9
10
In this article, you will learn how to model relationships and arbitrarily deep hierarchy between <Glossary>object</Glossary>s in your system with attribute scopes. By the end of this article, you will understand the fundamentals of modeling:
10
11
11
12
-**Folder-like structures** where objects contain other objects (ad infinitum)
@@ -16,26 +17,24 @@ The article assumes you know what <Glossary>object</Glossary>, <Glossary>edge</G
16
17
17
18
## Attribute Scopes
18
19
19
-
Attributes give one object permissions on another object. Each attribute has an <Glossary>attribute name</Glossary> (like `edit`) and an <Glossary>attribute scope</Glossary>. The value describes the permission and the scope describes which two objects are affected by the attribute. There are three scopes of attribute: direct, inherit and propagate.
20
+
Attributes give one object permissions on another object. Each attribute has an <Glossary>attribute name</Glossary> (like `edit`) and an <Glossary>attribute scope</Glossary>. The value describes the permission and the scope describes which two objects are affected by the attribute. There are three scopes of attribute: direct, inherit and propagate.
20
21
21
22
## Direct Attributes
22
23
23
-
The direct scope is the simplest attribute scope. It gives the source object the permission on the target object. It is used for non-hierarchical relationships.
24
+
The direct scope is the simplest attribute scope. It gives the source object the permission on the target object. It is used for non-hierarchical relationships.
24
25
25
26
26
27
27
-
28
28
## Inherit Attributes
29
29
30
30
The inherit attribute scope states:
31
31
32
32
> Inherit: if the target <Glossary>object</Glossary> has the attribute on a third object, the source object ‘inherits’ that attribute on the third object.
33
33
34
-
**Inherit attributes are used to pass a permission from one user or group to another**. In the example below, Gloria is a member of a department that owns a particular project. This is modeled by giving the department direct view access on the project, and passing that view access to Gloria with an inherit attribute.
34
+
**Inherit attributes are used to pass a permission from one user or group to another**. In the example below, Gloria is a member of a department that owns a particular project. This is modeled by giving the department direct view access on the project, and passing that view access to Gloria with an inherit attribute.
35
35
36
36
Copy file name to clipboardExpand all lines: content/docs/guides/(data-access)/proxy-and-plug-in-implementation/6-userclouds-browser-plug-in-documentation.mdx
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,11 +1,12 @@
1
1
---
2
-
title: "Browser Plug-in"
2
+
title: "Browser plug-in"
3
3
slug: "userclouds-browser-plug-in-documentation"
4
4
excerpt: ""
5
5
hidden: false
6
6
createdAt: "Thu Jun 13 2024 13:49:30 GMT+0000 (Coordinated Universal Time)"
7
7
updatedAt: "Fri Jun 28 2024 22:21:26 GMT+0000 (Coordinated Universal Time)"
8
8
---
9
+
9
10
### What Does It Do?
10
11
11
12
The UserClouds Browser Plug-in is designed to help you minimize, control, and log data access within web applications. It can be deployed in 15 minutes with no code changes, so is particularly useful in scenarios where:
@@ -19,11 +20,11 @@ Since the plug-in is installed locally, it is primarily aimed at internal data a
19
20
20
21
In combination with the UserClouds Proxy, the UserClouds Browser Plug-in allows you to:
21
22
22
-
- Tokenize and de-tokenize data in web applications without changing the application code.
23
+
- Tokenize and de-tokenize data in web applications without changing the application code.
23
24
- Control data access with fully expressive, context-aware access policies
24
25
- Log the who, when, why and how of data access
25
26
26
-
This can be achieved with minimal code changes or disruption to your development team or colleagues.
27
+
This can be achieved with minimal code changes or disruption to your development team or colleagues.
27
28
28
29
The approach helps:
29
30
@@ -43,7 +44,6 @@ The plug-in performs four core functions:
43
44
44
45
Purpose lifetimes and data deletion mechanisms play a crucial role in ensuring compliance with regulations like GDPR (General Data Protection Regulation). For example, a key principle of GDPR is storage limitation, which dictates that personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
15
16
16
17
This articles explains the mechanisms and configurations related to data deletion in UserClouds, especially in the context of user-defined data processing purposes and purpose lifetimes. The article assumes you are familiar with:
17
18
18
19
- How <Glossary>purpose</Glossary>s are used to track, enforce and audit user <Glossary>consent</Glossary> in User Store. Learn more [here](/docs/guides/definitions/purpose-and-consent).
19
-
- How the User Store is built from <Glossary>column</Glossary>s and populated with user records. Learn more [here](/docs/manage-your-columns).
20
-
- How <Glossary>mutator</Glossary>s and <Glossary>accessor</Glossary>s are used to write data to, and retrieve data from, the store. Learn more [here](/docs/accessors-read-apis).
20
+
- How the User Store is built from <Glossary>column</Glossary>s and populated with user records. Learn more [here](/docs/manage-your-columns).
21
+
- How <Glossary>mutator</Glossary>s and <Glossary>accessor</Glossary>s are used to write data to, and retrieve data from, the store. Learn more [here](/docs/accessors-read-apis).
21
22
22
23
## Introduction
23
24
24
-
Each piece of data in UserClouds is stored in an end user record and a column. It is also associated with a set of purposes, which describe the consents the end user has given for data processing. Data can exist in UserClouds in two lifecycle states:
25
+
Each piece of data in UserClouds is stored in an end user record and a column. It is also associated with a set of purposes, which describe the consents the end user has given for data processing. Data can exist in UserClouds in two lifecycle states:
25
26
26
27
-**Live data** is data that has not been deleted or marked for deletion
27
28
-**Soft-deleted data** is data that has been marked for deletion but is retained in a recoverable state for a specified period and set of purposes (like fraud detection), before being permanently erased
28
29
29
-
Data accessors must exclusively retrieve either live data _or_ soft-deleted data. No accessor can retrieve both. Only tenant admins can create and edit accessors for soft-deleted data.
30
+
Data accessors must exclusively retrieve either live data _or_ soft-deleted data. No accessor can retrieve both. Only tenant admins can create and edit accessors for soft-deleted data.
30
31
31
32
When a live piece of data changes, the old value becomes soft-deleted for the associated purposes if they have a non-zero post-deletion retention duration. Similarly, if a purpose is removed for a live piece of data, the data and purpose are soft-deleted if the post-deletion retention duration is non-zero. In either case the old value (or old purpose) will no longer be retrievable via a pre-deletion accessor.
32
33
33
34
## Configuring Purpose Lifetimes
34
35
35
-
Purpose lifetimes are set at the purpose-column level. Developers can configure two distinct time-based settings for each purpose-column pair:
36
+
Purpose lifetimes are set at the purpose-column level. Developers can configure two distinct time-based settings for each purpose-column pair:
36
37
37
38
-**The Pre-deletion Retention Duration** determines how long a specific purpose associated with a piece of data will be retained. Once this duration elapses, the purpose for that data expires. Once all the purposes have expired for the data, the data is soft-deleted. The clock for the purpose is reset can be reset by re-writing the data to the store. This duration is most commonly used to reflect the Storage Limitation principle of legislation like GDPR. The default setting is indefinite, meaning the purpose will not expire and that the value will be accessible for that purpose, until the data is deleted or changed, or the purpose is removed.
38
39
-**The Post-deletion Retention Duration** specifies the duration for which data should be retained in a "soft-deleted" state after a deletion event occurs. Once the Post-deletion Retention Duration elapses, the associated purpose expires. When all purposes are deleted for a specific piece of data, the data is no longer accessible by any means. This duration is most commonly used to enable account recovery and fraud/integrity investigations. The default setting is 0, meaning that old data is immediately hard-deleted when it is deleted or changed.
39
40
40
41
Any changes to pre- or post-deletion retention durations for a purpose only apply to newly written data. Retention timeouts for existing data cannot be retroactively changed by changing the retention duration associated with that column or purpose. However, if a retention duration is updated, any newly written data after the fact will have a timeout based on the new retention duration.
41
42
42
43
## Deletion Process Flow
44
+
43
45
<Steps>
44
46
<Step>End user data is saved to the store with associated purposes.</Step>
45
-
<Step>Pre-deletion Retention Duration countdown begins for each associated purpose.</Step>
46
-
<Step>If data is updated with the same purpose before Pre-deletion Retention Duration elapses, the purpose retention clock is reset.</Step>
47
-
<Step>If the pre-deletion retention duration elapses, the data is no longer visible for that purpose as live, pre-delete data.</Step>
48
-
<Step>Deletion event occurs (e.g. a value update, a value deletion, a column deletion or a user deletion) triggering the Post-deletion Retention Duration.</Step>
49
-
<Step>Once Post-deletion Retention Duration elapses, the associated purpose is deleted.</Step>
50
-
<Step>When all purposes are deleted for a piece of data, the data is no longer accessible by any means.</Step>
47
+
<Step>
48
+
Pre-deletion Retention Duration countdown begins for each associated
49
+
purpose.
50
+
</Step>
51
+
<Step>
52
+
If data is updated with the same purpose before Pre-deletion Retention
53
+
Duration elapses, the purpose retention clock is reset.
54
+
</Step>
55
+
<Step>
56
+
If the pre-deletion retention duration elapses, the data is no longer
57
+
visible for that purpose as live, pre-delete data.
58
+
</Step>
59
+
<Step>
60
+
Deletion event occurs (e.g. a value update, a value deletion, a column
61
+
deletion or a user deletion) triggering the Post-deletion Retention
62
+
Duration.
63
+
</Step>
64
+
<Step>
65
+
Once Post-deletion Retention Duration elapses, the associated purpose is
66
+
deleted.
67
+
</Step>
68
+
<Step>
69
+
When all purposes are deleted for a piece of data, the data is no longer
- If data is re-written with a new `Marketing` or `FraudAndIntegrity` consent within 1 year, the clock for that consent resets.
@@ -62,5 +83,5 @@ Any changes to pre- or post-deletion retention durations for a purpose only appl
62
83
- At this point, the data can no longer be accessed for marketing purposes.
63
84
- The data is retained in a soft-deleted state for 3 years for `FraudAndIntegrity` purposes
64
85
- During this time, it can only be accessed by accessors with the `FraudAndIntegrity` purpose, which are specifically configured by a tenant admin to access soft-deleted data
65
-
- After 3 years, the `FraudAndIntegrity` consent is deleted.
86
+
- After 3 years, the `FraudAndIntegrity` consent is deleted.
66
87
- At this point, since this data has no consents for data processing attached to it, it is permanently and irrecoverably deleted from the store.
Copy file name to clipboardExpand all lines: content/docs/guides/(data-tokenization)/tokenization-overview/demo-video.mdx
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,11 +1,12 @@
1
1
---
2
-
title: "Demo Video"
2
+
title: "Demo video"
3
3
slug: "demo-video"
4
4
excerpt: "This video covers what tokenization is and why to use it, as well as how to manage your tokenization policies in the UserClouds Console and UserClouds API."
5
5
hidden: true
6
6
createdAt: "Thu Aug 03 2023 21:54:59 GMT+0000 (Coordinated Universal Time)"
7
7
updatedAt: "Wed Jun 19 2024 17:13:12 GMT+0000 (Coordinated Universal Time)"
> 🚧 Note: because this configuration provides no monitoring, automatic restarts, failover, etc, this configuration is intended ONLY for development, test, and CI environments. Do not use this configuration for production - otherwise outages and data loss may occur.
10
11
11
12
This guide provides step-by-step instructions on deploying the UserClouds Docker container on an Amazon EC2 instance. This setup is useful for environments where you need to manage the Docker container lifecycle manually.
12
13
13
-
## Prerequisites
14
+
###Prerequisites:
14
15
15
16
- AWS Account
16
17
- AWS CLI configured
17
18
- Docker installed locally
18
19
19
-
Steps
20
+
### Steps:
20
21
21
22
1.**Launch an EC2 Instance**
22
-
1.**Log in to the AWS Management Console.**
23
+
1.**Log in to the AWS Management Console**
23
24
2.**Launch an Instance:**
24
-
1. Navigate to EC2 Dashboard and click "Launch Instance".
25
+
1. Navigate to EC2 Dashboard and click "Launch Instance"
25
26
2. Choose an Amazon Machine Image (AMI). For this guide, we will use the Amazon Linux 2 AMI.
26
27
3. Select an instance type. A t2.micro instance is sufficient for testing, but choose according to your needs.
27
28
4. Configure other instance details as required.
28
29
5. Configure security groups:
29
30
1. Allow SSH (port 22) from your IP address.
30
31
2. Allow HTTP (port 80) and HTTPS (port 443)
31
32
3.**Review and Launch:**
32
-
1. Review your instance settings and click "Launch".
33
-
2. Select an existing key pair or create a new one to access your instance.
34
-
3. Click "Launch Instances".
33
+
1. Review your instance settings and click "Launch"
34
+
2. Select an existing key pair or create a new one to access your instance
35
+
3. Click "Launch Instances"
35
36
4.**Connect to Your Instance:**
36
-
1. Once the instance is running, click "Connect" and follow the instructions to SSH into your instance.
37
+
1. Once the instance is running, click "Connect" and follow the instructions to SSH into your instance
37
38
2.**Install Docker on the EC2 Instance**
38
39
1. Update the Installed Packages: `sudo yum update -y`
3. Start the Docker Service: `sudo service docker start`
41
42
4. Add the ec2-user to the Docker Group: `sudo usermod -a -G docker ec2-user`
42
43
5. Log Out and Log Back In (to ensure your user permissions are updated)
43
44
3.**Pull the UserClouds Docker Image**
44
-
1. Reach out to your UserClouds point of contact to obtain the Docker image and any necessary credentials for accessing the Docker registry where the image is hosted.
45
+
1. Reach out to your UserClouds point of contact to obtain the Docker image and any necessary credentials for accessing the Docker registry where the image is hosted
45
46
4.**Run the UserClouds Docker Container**
46
47
1. Run the Docker Container: `docker run -d --name userclouds-container -p 80:80 name-goes-here`
47
-
1. Replace `name-goes-here` with the name of the UserClouds Docker image.
48
+
1. Replace `name-goes-here` with the name of the UserClouds Docker image
48
49
2. Adjust the port mapping (`-p 80:80`) as needed.
49
50
5.**Verify the Deployment**
50
51
1. Check Running Containers: `docker ps`
51
-
2. Access Your Application: Open a web browser and navigate to the public IP address of your EC2 instance. You should see the UserClouds application running.
52
+
2. Access Your Application: Open a web browser and navigate to the public IP address of your EC2 instance. You should see the UserClouds application running
52
53
6.**Manual Lifecycle Management**
53
54
1. Since the Docker container will not automatically restart if the EC2 instance is terminated, you need to manage the lifecycle manually. Here are some commands to help:
54
55
1. Stop the Docker Container: `docker stop userclouds-container`
0 commit comments