The data stores on customer infrastructure consist of the customer-hosted S3 bucket if this deployment option is chosen. The customer owns the data in this S3 bucket, and its backup is the customer’s responsibility according to their backup policies and procedures.
The customer can use any AWS supported methods for protecting and/or backing up their S3 bucket. Darwinium can only access customers' hosted buckets through cross-account roles they control. Customer roles created according to our installation documentation only provide Darwinium with Write-Once Read-Many (WORM) permissions; in particular, Darwinium cannot delete objects from customer S3 buckets. Darwinium recommends that Bucket Versioning is enabled on the bucket, which further ensures the protection of customer data in their bucket.
Furthermore, the customer can employ AWS functionality such as S3 replication or AWS Backup for S3 if they want to further protect their customer-hosted S3 data. Please note that the average object size stored in the S3 bucket is 5-7KB. Customers are advised to consider that the object size overheads of options such as AWS Glacier are much larger than this, which may result in increased storage space usage.
GDPR
Data regulation laws have an impact on data backup policies. As an example, a restored backup should not restore a previously deleted record that is part of a GDPR request.
- When a right to delete request is received, Darwinium will soft delete the data by removing references in our search indexes, preventing that data from being served in our Portal
- However, if a customer is hosting their own S3 bucket, Darwinium will not be able to hard-delete the data that is the subject of a GDPR request inside a customer bucket. This is because of the policy controls outlined above that ensure Darwinium only has WORM access to customer hosted S3 buckets.
- Therefore, the onus of hard deleting data subject to GDPR that is stored in a customer S3 bucket lies with the customer
- If data is stored in a Darwinium hosted S3 bucket, Darwinium will take responsibility for performing hard deletes on data that is subject to a GDPR deletion request.