Privacy Architecture

SANKET is designed to collect what it needs to deliver communications securely, to keep it inside the customer's boundary, and to delete it on a defined schedule. Customers remain the controllers of personal data in their installations; this chapter describes the technical measures, not legal compliance.

44.1 Principles Applied

• Data minimisation: content is end-to-end encrypted, including reactions, encrypted broadcasts and classification labels; phone and email are optional; notifications carry no content by default; the user directory is not enumerable.
• Purpose limitation: metadata is used for delivery, security and accountability; usage analytics are first-party, content-free counters computed within the installation, which the organisation can switch off and an installation can lock off, after which nothing is collected.
• Administrator visibility is limited by role and never extends to content.
• Deletion: delivered ciphertext is tombstoned; disappearing messages expire; retention windows prune metadata; account self-deletion (optional) revokes devices and removes the account from use.
• Access records: administrator actions and security events are audited.

44.2 Retention Schedule

Table 70: Default retention of server-held data

Shrinking a retention window is itself an audited administrative action.

44.3 Personal Data Inventory

Personal data held by the server comprises the Sanket ID, display name, optional email and phone, profile fields, device information (platform, model, app version, hardware protection level and the fingerprint of the device's client certificate, which itself carries an opaque random name), each account's signed device list, IP addresses and user agents in audit records, group memberships and names, and communication metadata (Chapter 20). Where federated sign-in is configured, it also holds the mapping from the customer's identity provider or directory to the administrator account or Sanket ID; accounts are never created from the provider. Email and phone are stored in clear.

The server does not hold the emoji of any reaction (where the large-group count option is on, it learns only who reacted to which message), the title, body or attachments of an encrypted broadcast (only its audience, priority, deadline, expiry and receipts; notice broadcasts remain readable), or the classification label of any message or file. Usage analytics are pseudonymous counts, collected only while the organisation's switch is on and never on an installation locked against them; the organisation can delete everything collected at any time. Audit records and the app version each device reports for update enforcement are not analytics and are kept regardless. End users can review their own security activity. Export of user data by users is off by default.