Data Confidentiality / Privacy

[#1]

Hello Apigee Community

One of our client has raised concerns that their data is confidential and they don't want it to go through an external API Gateway.

Since we provide Apigee with the certificate (including private key) in a keystore. I imagine that you can analyze and decrypt the entire communication. Not just headers etc.
Does this question arise frequently and do you have any documentation we could refer our client to, to reassure them that their data is dealt with carefully.

I would like to know what Apigee does to ensure

a) to keep our transferred data safe

b) what you do so that nobody can access the content of the data transferred through your system, despite you having the keystore

----

We only have a few API's and not that high volume traffic – based on our current usage running Apigee on premise doesn't seem like a viable solution.

[anilsr · Accepted solution]

@Roland , Welcome to Apigee Community !!

You can safely use Public cloud to host your APIs just like other Apigee customers including large banks, financial institutions, telcos etc who trust Apigee to expose their APIs. As you know, Apigee is part of Google Cloud where security is critical just like any other Google product that billions use through out the world.

Regarding, Private Keys, They are encrypted with strong cryptographic algorithms at rest. Apigee personal can't read this information directly by accessing cassandra.

Regarding, Transferred data safe, We don't capture any API Request / Response data that is transferred through Apigee Edge Platform. Only meta info of APIs like API Latency, #Traffic etc captured for API Analytics purpose.

Apigee also provides data masking functionality for APIs to restrict visibility of data during trace / debug. You can control who can access your API Management platform with defined roles & permissions.

Hope it helps. Keep us posted if any.

@jwyatt FYI..

-------------------------------

Anil Sagar

Learn Apigee Concepts in 4 Minutes HandsOn