Overview
Prizm employs comprehensive data protection measures across the entire data lifecycle. Data protection in Prizm is a layered system designed to protect data at rest, in transit, and during processing. All protection mechanisms are continuously monitored and enforced through automated controls.Encryption Standards
Data at Rest
All data stored within the Prizm platform is encrypted at rest to protect against unauthorized access to the underlying storage infrastructure.Data in Transit
All data transmitted between clients and the Prizm platform, as well as between internal services, is encrypted using modern TLS standards.- TLS 1.3 enforced for all external client connections
- TLS 1.2 minimum for legacy system compatibility (configurable)
- Certificate pinning available for mobile and thick client integrations
- HSTS (HTTP Strict Transport Security) enabled for all web interfaces
- Mutual TLS (mTLS) supported for service-to-service communication
Data Classification
Classification Levels
Prizm uses an automated tagging system to categorize data sensitivity. Classification is applied at ingest and can be updated by authorized users.Automated Classification
Prizm’s classification engine applies tags to data based on:- Pattern matching for known PII formats (SSN, credit card numbers, email addresses)
- Machine learning models trained on labeled enterprise data sets
- Keyword and metadata analysis based on configurable rule sets
- Manual override by authorized data stewards
Access Controls
Fine-grained access controls enforce data classification policies across the platform:- Access to classified data requires an explicit role assignment that includes the relevant tag
- The RBAC + ABAC model enables tag-based filtering (see Role-Based Access Control)
- Data owners can grant and revoke access to resources within their domain
- Temporary access grants with configurable expiry are supported via
assignment.expiry_date - Emergency access procedures require dual approval and are fully audited
Data Masking and Tokenization
PII and sensitive data is masked for users who are not explicitly granted PII access, protecting sensitive information while maintaining data utility for analytics and reporting.Audit Logging
Comprehensive audit logging tracks all data access and modification events:Immutable logs
Audit logs are stored separately from operational data and cannot be modified or deleted.
Full operation coverage
Every read, write, and delete operation is logged with user, timestamp, and resource.
Configurable retention
Log retention follows configurable policies. Minimum 1 year recommended for compliance.
SIEM integration
Logs are exportable in JSON and CSV formats and support real-time SIEM streaming.
Real-time alerting is available for anomalous access patterns and policy violations. Configure alert rules in Admin Settings → Audit & Alerts.
Key Management
Encryption key management follows industry best practices:- Hardware Security Modules (HSM) protect master encryption keys
- Vault integration provides secrets management for application credentials
- Key rotation schedules are enforced automatically (configurable intervals)
- Key escrow and recovery procedures are documented and tested annually
- Separate keys are used for different data classifications and environments
Data Residency
Prizm supports data residency requirements for regulated industries and jurisdictions:- Data region selection is configurable at the tenant level
- Cross-region replication can be restricted for sensitive data classifications
- Data residency controls are enforced at the storage layer and documented for compliance audits
Encryption Standards
Data at Rest
All data stored within the Prizm platform is encrypted at rest to protect against unauthorized access to the underlying storage infrastructure.Data in Transit
All data transmitted between clients and the Prizm platform, as well as between internal services, is encrypted using modern TLS standards.- TLS 1.3 enforced for all external client connections
- TLS 1.2 minimum for legacy system compatibility (configurable)
- Certificate pinning available for mobile and thick client integrations
- HSTS (HTTP Strict Transport Security) enabled for all web interfaces
- Mutual TLS (mTLS) supported for service-to-service communication
Data Classification
Classification Levels
Prizm uses an automated tagging system to categorize data sensitivity. Classification is applied at ingest and can be updated by authorized users.Automated Classification
Prizm’s classification engine applies tags to data based on:- Pattern matching for known PII formats (SSN, credit card numbers, email addresses)
- Machine learning models trained on labeled enterprise data sets
- Keyword and metadata analysis based on configurable rule sets
- Manual override by authorized data stewards
Access Controls
Fine-grained access controls enforce data classification policies across the platform:- Access to classified data requires an explicit role assignment that includes the relevant tag
- The RBAC + ABAC model enables tag-based filtering (see Role-Based Access Control)
- Data owners can grant and revoke access to resources within their domain
- Temporary access grants with configurable expiry are supported via
assignment.expiry_date - Emergency access procedures require dual approval and are fully audited
Data Masking and Tokenization
PII and sensitive data is masked for users who are not explicitly granted PII access, protecting sensitive information while maintaining data utility for analytics and reporting.Audit Logging
Comprehensive audit logging tracks all data access and modification events:Immutable logs
Audit logs are stored separately from operational data and cannot be modified or deleted.
Full operation coverage
Every read, write, and delete operation is logged with user, timestamp, and resource.
Configurable retention
Log retention follows configurable policies. Minimum 1 year recommended for compliance.
SIEM integration
Logs are exportable in JSON and CSV formats and support real-time SIEM streaming.
Real-time alerting is available for anomalous access patterns and policy violations. Configure alert rules in Admin Settings → Audit & Alerts.
Key Management
Encryption key management follows industry best practices:- Hardware Security Modules (HSM) protect master encryption keys
- Vault integration provides secrets management for application credentials
- Key rotation schedules are enforced automatically (configurable intervals)
- Key escrow and recovery procedures are documented and tested annually
- Separate keys are used for different data classifications and environments
Data Residency
Prizm supports data residency requirements for regulated industries and jurisdictions:- Data region selection is configurable at the tenant level
- Cross-region replication can be restricted for sensitive data classifications
- Data residency controls are enforced at the storage layer and documented for compliance audits