Security

The following chapters will explain what data will be send to our servers and how this will be done.

General

process.science is not SAAS. All load-jobs and data conversion is done where you installed the software we provided. None of the data you are analyzing will leave your premise unless you install the software provided by us on an external system (like a virtual machine or a server rented in an external datacenter) or unless you decide to publish your data to a SAAS solution like Power BI online.
In particular, none of the data you are loading is loaded or analyzed using any of our systems.

Communication partners

process.science for Power BI: SSIS-package

The SSIS-Package is a software used to transform the source data (event log) to a form that can be visualized. It is deployed into a MS-SQL database. The SSIS-packace will be running in the background without direct user interaction to do transformations on data in the database it is connected to and to write back the result of the transformation.
The SSIS-Package usually is installed on a database server. From there it will communicate with

1. the central license server of process.science or - for large installations - with a license server installed on premise.

process.science for Power BI: Event Log Transformer

The Transformer is a standalone software similar to the SSIS-Package, but on a locally exported of data, without the need for a database.
The Transformer is usually installed on a users computer, next to an installation of Power BI-Desktop. From there it will communicate with

1. the central license server of process.science or - for large installations - with a license server installed on premise.

process.science for Power BI: Visuals

The visuals are the graphs the user is interacting with to visualize and filter the data analyzed. Visuals are either delivered to the users webbrowser from their instance of Power BI (whether on premise or online) or in the form of Power BI-Desktop. Whether in a webbrowser or a local installation of Power BI-Desktop, in all cases the visuals are executed locally on the users' computer. From there they will communicate with

1. the central license server of process.science or - for large installations - with a license server installed on premise

License server

While the core of our business is providing customers with tools to analyze data, process.science as a German company is very conscious about the data we collect. Data can be a liability so we try to minimize the data collected, especially if it touches our customers' business. This is how we do license checks:

Our customers install an individually generated license (a file with the extension '.pslicense') on their system that contains information on the agreed upon usage terms for the software (e.g. number and kind of users), a contact email to send updated to and some cryptographically hashed information identifying the user accounts who may use the product.
The encrypted information on the user accounts can not be reverted and it is only saved into your license file, we don't have it on file. That means that we don't know who you assigned a user license to. Using our self service online you can generate a new license for a new set of users.

Information sent

The license server is called by all software of process.science on startup and while the software is used with this information:

• the license
• the accountname of the user (if applicable). The result of the USERNAME measure is used.
• an anonymous session ID (for the visuals/extensions used in the browser)

The license server replys with information about the validity of the license for this specific request and - if it is not valid - the cause for rejection.
To track the maximum number of concurrent users the session ID is stored temporarily, until a session has been idle for more than 10 minutes.

The license server must be directly accessible over a network connection from all components of our software, except from the Qlik Sense Extensions. For large installations the license server can be installed on-premise or as a dedicated license server online. Tampering with the installation in a way to change the communication with the license server - especially the result of this communication with the direct or accidental aim to avoid the enforcement of the licensing is a breach of contract.

Network connections

The central license server most customers use is running on Microsoft Azure, so we can ensure high availability and geographical distribution of this essential service.
Unless configured otherwise, the components of process.science will connect to

• license.process.science Port 443

This domain has the Canonical Name pslicense.azurewebsites.net which will resolve to an IPv4-address appropriate to your geographical location.

If using the central license server, all components (except from the Qlik Sense Extensions) must be able to resolve license.process.science and connect to the IPv4 address that it is resolving to.
You can test your setup by accessing 'https://license.process.science/api/TestConnection'.