IBM DevOps Velocity Considerations for GDPR Readiness

Personal data used for online contact with IBM

IBM DevOps Velocity clients can submit online comments/feedback/requests to contact IBM about product topics in a variety of ways, primarily the comment areas of the following, as applicable:

Typically, only the client name and email address are used, to enable personal replies for the subject of the contact, and the use of personal data conforms to the IBM Online Privacy Statement.

Data Collection

Please review:

Data Storage

Deployments are orchestrated by the server and performed by agents distributed throughout the network. The file store, CodeStation, contains log files, artifacts, and other non-structured data objects. Reporting tools can connect directly to the relational database.

The file store manages artifacts in a secure and and tamper-proof repository that ensures deployed artifacts are identical to those tested in preproduction environments.

Protection

IBM DevOps Velocity uses several technologies to provide security. Some features can be configured to meet client requirements such as Transport Layer Security (TLS). Some features are disabled by default, such as mutual authentication.

Please also review:

Data Access

The IBM DevOps Velocity team- and role-based security system manages user interactions and secures product features. Roles control virtually every product area, including the objects that users can create and who can modify the security system itself. User-created objects are managed by teams. Team members can only access objects, such as applications, managed by their team. Team members interact with team-managed objects according to the permissions granted to their role.

Logging administration activity:

Administrative activity is kept in the system logs. instances when the admin user adds a user or changes a users role and permissions are tracked in the log.

Please also review:

Data Processing

Users control the way in which IBM DevOps Velocity interacts with data passing through it by their definition of task and application processes. A process is commonly constructed by a user acting in the role of “developer” working with the component plugin toolkit. A process is composed of discrete building blocks (known as steps) that are joined together by the developer.

Who has access to the Data?

Most customers import users from external LDAP realms. Clients filter LDAP account data for the information they need, such as user IDs, email addresses, and passwords. Groups that the imported users belong to are also imported.

Permissions are assigned to roles and users and groups are placed into roles when they are placed onto teams. Users without roles have read-only privileges and cannot access data let alone modify it.

Encryption:

Communication between server and clients or external systems and can be secured by using SSL and TLS, with optional mutual key-based authentication for each end-point. This communication protocol is stateless and resilient to network outages.

Please also review:

Data Deletion

Please review: