Skip to main content

Handling Personally Identifiable Information (PII)

Nevis manages fields marked as PII in this documentation as though they contain personal information or personal data. This means that Nevis implements technical and organizational security controls as appropriate to the risk associated with that data. For example, data will not be visible to Nevis employees unless they are acting as a surrogate for you, for example debugging on your behalf, or have other legitimate business needs to access it. Also note that values are anonymized or removed when we need to hold on to information for statistical analysis, reporting, and capacity planning; none of which require the PII itself.

Hashing PII

For increased user privacy needs, PII data can be hashed before sending it to the Authentication Cloud.

Exceptions

  1. PII data within approvals cannot be hashed and must be plain text. Note that this information is stored only for the duration of the approval. This includes the content of the message.
  2. The name of the authenticator that is sent directly from the phone can contain PII data, such as the first name of a user.

For hashing we recommend using the following scheme (pseudo code):

Prefix    = "u_"               // static prefix to make sure Result starts with A-Z / a-z
Secret = "my-secret" // static secret that never changes
Data = "[email protected]" // username with PII to hash

Result = Prefix + BASE64( HMAC( "SHA-256", Secret, Data ), urlsafe: True, noPadding: True )

The resulting hashed PII will look like this:

"u_zz6raA4lSDrnOyWZdf_t1FueEcHpLACLGHsg7oCmFqo"