Securing your data in IBM Cloudant
IBM Cloudant DBaaS data protection and security
Protecting application data for large-scale web and mobile apps can be complex, especially with distributed and NoSQL databases.
Just as it reduces the effort of maintaining your databases to keep them running and growing nonstop, IBM® Cloudant® for IBM Cloud® also ensures that your data stays secure and protected.
Tier one physical platforms
The IBM Cloudant DBaaS is physically hosted on Tier-1 cloud infrastructure providers such as IBM Cloud® and Amazon. Therefore, your data is protected by the network and physical security measures that are employed by those providers, including (but not limited to):
- Certifications - Compliance with SSAE16, SOC2 Type 1, ISAE 3402, ISO 27001, CSA, and other standards.
- Access and identity management.
- General physical security of data centers and network operations center monitoring.
- Server hardening.
- IBM Cloudant gives you the flexibility to choose or switch among the different providers as your SLA and cost requirements change.
More details about the certifications are available in the Compliance information.
Secure access control
IBM Cloudant has a multitude of built-in security features, for you to control access to data:
| Feature | Description |
|---|---|
| Authentication | IBM Cloudant is accessed by using an HTTPS API. Where the API endpoint requires it, the user is authenticated for every HTTPS request IBM Cloudant receives. IBM Cloudant supports both legacy and IAM access controls. For more information, see the IAM guide or the legacy Authentication document. |
| Authorization | IBM Cloudant supports both legacy and IAM access controls. The IBM Cloudant team recommends that you use IAM access controls for authentication whenever possible. If you're using IBM Cloudant legacy authentication, it is recommended that you use API keys rather than account-level credentials for programmatic access and replication jobs. For more information, see the IAM guide or the legacy Authentication document and the legacy Authorization document. |
| At-rest encryption | All data that is stored in an IBM Cloudant instance is encrypted at rest by using LUKS1 with 256-bit Advanced Encryption Standard (AES-256). By default, IBM Cloudant manages the encryption keys for all environments. If you require bring-your-own-key (BYOK) encryption for encryption-at-rest, you enable it by using your encryption key that is stored in an IBM Cloud Key Protect instance. IBM Cloudant supports the BYOK feature for new IBM Cloudant Dedicated Hardware plan instances that are deployed in all regions. For more information, see the Creating an IBM Cloudant Dedicated Hardware plan instance tutorial for details on how to choose BYOK at provisioning time. |
| In-flight encryption | All access to IBM Cloudant is encrypted by using HTTPS. |
| Client-side encryption | Customers can use client-side encryption to ensure that the data protection is controlled by the data owner and the data is never visible to the service provider. |
| TLS | IBM Cloudant requires the use of TLS 1.2+. IBM Cloudant strongly recommends that you do not pin certificates in your application. Certificates renew regularly, at least annually, and intermediate and root certificates could change when they do. IBM Cloudant does not send out notifications before certificate renewals. We recommend that you keep your certificate truststore up to date with the latest root certificates. IBM Cloudant acquires its certificates from DigiCert. You can find their root certificates on the DigiCert Trusted Root Authority Certificates page. IBM Cloudant sends a notification if we move to a different certificate authority. |
| Endpoints | All IBM Cloudant instances are provided with external endpoints that are publicly accessible. Dedicated Hardware environments created after 1 January 2019 outside of the EU-managed cloud also add internal endpoints for all Standard plan instances deployed on them. Using internal endpoints allows customers to connect to an IBM Cloudant instance through the internal IBM Cloud® network to avoid upstream application traffic from going over the public network and incurring bandwidth charges. For more information, see Service Endpoint documentation for more details on enabling Service Endpoints for your IBM Cloud® account. |
| IP allowlisting | IBM Cloudant customers, who have a dedicated IBM Cloudant environment, can allowlist IP addresses to restrict access to only specified servers and users. IP allowlisting isn't available for any IBM Cloud Public Lite or Standard plans that are deployed on multi-tenant environments. Open a support ticket to request IP allowlists for a specified set of IP or IP ranges. IP allowlists apply to both the IBM Cloudant API and Dashboard, so be mindful to include any administrator IP that needs to access the IBM Cloudant Dashboard directly. |
| CORS | Enable CORS support for specific domains by using the IBM Cloudant Dashboard or API. For more information, see the CORS documentation. |
Protection against data loss or corruption
IBM Cloudant has a number of features to help you maintain data quality and availability:
| Feature | Description |
|---|---|
| Redundant and durable data storage | By default, IBM Cloudant saves to disk three copies of every document to three different nodes in a cluster. Saving the copies ensures that a working failover copy of your data is always available, regardless of failures. |
| Data Replication and export | You can replicate your databases continuously between clusters in different data centers or Apache CouchDB. Another option is to export data from IBM Cloudant (in JSON format) to other locations or sources (such as your own data center) for added data redundancy. |
Deleting your data in IBM Cloudant
You can delete individual documents in the IBM Cloudant Dashboard or by using an API. Documents are not technically deleted but instead are compacted.
For more information, see Deletion of data.
To delete a document, follow these steps:
- Go to IBM Cloudant Dashboard.
- On the Databases page, click the database that contains the documents that you want to delete.
- Click the checkbox next to the documents that you want to delete.
- Click Delete.
The document is selected for compaction.
For more information, see Delete a document in the API Reference documentation.
Deleting IBM Cloudant instances
You can delete a database instance in the IBM Cloudant Dashboard or by using an API.
Once an instance is deleted, all data within the database, as well as the account-level information, such as authentication data, is deleted automatically after the 7-day grace period ends. IBM Cloudant doesn’t hold any contact details for the instances that are created by using the platform. If you have support tickets with IBM Cloudant where you shared information, such as email addresses, that information isn’t removed by this process.
To delete a database, follow these steps:
- Go to IBM Cloudant Dashboard.
- On the Databases page, click Delete next to the database you want to delete.
- Type in the name of the database you want to delete.
- Click Delete Database.
The database is removed from the list of databases.
A database deletion cannot be undone.
For more information, see Delete a database in the API Reference documentation.
The IBM Cloudant data retention policy describes how long your data is stored after you delete the service. The data retention policy is included in the IBM Cloudant service description, which you can find in the IBM Cloud Terms and Notices.
Restoring deleted data for IBM Cloudant
If you delete your account, you have a 7-day grace period during which you can cancel the request to delete it.
A database deletion cannot be undone.