Zammo is created with enterprise-grade software, security, privacy and service standards built on Microsoft Azure. All data with Zammo is transmitted over HTTPS. Zammo uses a centralized data storage (Azure SQL server) where the data is clustered with an identifier related to each business. Databases are secured with Role-Based Access Control, which significantly limits the number of users capable of accessing the database and making changes to it.

Microsoft LUIS’s data security and privacy article is located here: Data and privacy for Language Understanding (LUIS) - Azure Cognitive Services | Microsoft Docs

For data that is at rest (in the Zammo database), we have a feature that we can implement for you to automatically redact PII so that personal data is never stored anywhere and will not show up in analytics.

Zammo offers two layers of protection for PII:

To prevent PII from getting into the analytics database:

1. The data is filtered and obfuscated before it is stored in the database. Personal data such as email address, IP address, US mailing address, SSN, and US phone number can be filtered. The filter can be turned on specifically for the customer use case, and users are only able to see stars in the analytics report.
2. The customer can choose to turn off analytics altogether to prevent any data from being logged.

Once data has been stored in the analytics database:

1. The data is stored in an SQL server in the Microsoft Azure Cloud that includes:
   1. Firewall Access - Only individuals with a specific IP address can have access to the database.
   2. Strong Password - Only specific authorized users have access to the system. At the database level, a user role needs to be authorized prior to access. The user must not only have the password, but they must also have their specific network IP authorized as well.