Privacy

Platform.sh's privacy team operates with unwavering diligence, regularly monitoring and assessing the evolving landscape of privacy laws and regulations. This ongoing commitment ensures that the company remains in strict compliance with all pertinent legal frameworks, wherever it conducts business. Furthermore, when Platform.sh makes the decision to expand into new geographic regions, the privacy team takes a proactive stance in researching and adhering to local regulations. By embracing this forward-looking and adaptive approach to privacy, Platform.sh demonstrates its commitment to safeguarding user data and maintaining the highest standards of compliance in a diverse global privacy environment.

Due to Platform’s commitment to providing 24/7 support to our customers regardless of their geographical location, we have support teams dispersed globally. Our GDPR Everywhere approach ensures our support teams undergo the same rigorous privacy and security training, and must comply with the same set of policies and legal requirements regardless of where they are physically located (e.g., prohibition of downloading customer data on their local machines). Members of the support teams are subject to Platform.sh privacy, security, and data protection standards. To ensure compliance with GDPR, Support teams never download any customer data, making sure customer data never leaves its servers. This guarantees a cohesive and consistent approach to data protection and privacy across all personnel involved in Platform.sh operations. This approach ensures that data is handled with the utmost care and compliance with GDPR, HIPAA, and other privacy regulations throughout the support network.

Platform.sh also extends this commitment to its vendor relationships. Before onboarding any vendor, a rigorous evaluation process is in place regarding the vendor’s privacy and security measures and overall compliance with applicable laws. This assessment includes a review of the vendor’s privacy policies, data transfer agreements, security posture, and any other information that helps Platform.sh ensure the vendor adequately protects personal information in line with global standards. This proactive approach underscores Platform.sh's dedication to maintaining the highest level of data protection, not only within its own systems but also, in collaboration with its partners and vendors, ensuri ng the privacy and security of customer data remain protected at every touchpoint in the business ecosystem.

Platform.sh is proud to affirm its compliance with the Schrems II ruling, demonstrating a commitment to safeguarding data transfers to countries with inadequate privacy protections. To ensure compliance, the company conducts Supplementary Measure Assessments with vendors situated in regions lacking sufficient data protection regulations. Furthermore, Platform.sh has updated its Data Transfer Agreements with a specific provision referred to as "Additional Guarantees," which provisions supplementary security obligations. This ensures that data transfers to inadequate countries adhere to the highest standards of data protection, meeting the requirements of the Schrems II ruling and reinforcing Platform.sh's dedication to maintaining data privacy and security at the core of its operations.

The European Data Protection Board's recommendations 01/2020 offer guidelines for ensuring the secure processing and handling of personal data in accordance with the General Data Protection Regulation (GDPR). In particular, Case number 1 within these recommendations addresses the storage of data for backup and other purposes where unencrypted access to the data is not necessary.

Platform.sh asserts its compliance with Case number 1, which involves several key measures. Firstly, personal data is processed using robust encryption protocols before transmission, and the identity of the importer is rigorously verified, enhancing data security. Secondly, the strength of encryption and the key length are carefully tailored to consider the specific duration during which the confidentiality of the encrypted personal data needs to be maintained. Moreover, the chosen encryption algorithm and its parameters are designed to resist cryptanalysis by public authorities in the recipient country, ensuring robust data privacy. Lastly, Platform.sh ensures that encryption keys are exclusively under the control of the data exporter or entrusted to an entity within the EEA or a jurisdiction offering an equivalent level of data protection, thus reinforcing data security in line with EDPB's recommendations 01/2020.

To ensure the utmost protection of our customers' data, we employ encryption at multiple layers of our infrastructure. Specifically, we encrypt the disks where customer data is stored, implementing robust encryption protocols. In this process, both encryption keys are securely managed, with Platform.sh and our trusted Cloud Provider Key Management System retaining access to these keys. However, we also acknowledge the importance of flexibility and empowerment for our customers. Hence, we offer our customers the freedom and capability to design and implement their own encryption solutions at the application and database levels should they desire additional layers of data encryption. This approach ensures that our customers have the autonomy to tailor their data security measures to their specific needs, further enhancing the protection of their valuable information within our platform.

The EU-U.S. Data Privacy Framework (EU-U.S. DPF) serves as a data transfer mechanism under the EU General Data Protection Regulation (GDPR) on the basis of an adequacy decision from the European Commission. The European Commission’s adequacy decision for the EU-U.S. DPF entered into force on July 10, 2023. This mechanism enables participating organizations to meet the EU requirements for transferring personal data to third countries.

Platform.sh pursued certification to align with the Data Protection Framework, demonstrating the company's commitment to adhere to established standards.Additionally, Platform.sh relies on Standard Contractual Clauses and Data Processing Agreements with its vendors, and IaaS providers globally.