Supplemental Controls and Policies

For customers seeking to implement B2C Service in a regulation-controlled environment, we implement and manage a series of supplemental controls and policies.

There are supplemental Oracle-managed controls that are specific to the Oracle SaaS offering. These controls are automatically established when deploying an instance of B2C Service within the specific cloud environment.

Oracle Staff Restrictions

For Oracle environments that are designed to meet additional controls such as PCI or HIPAA, Oracle incorporates access control mechanisms that restrict Oracle personnel based on need-to-know, relevant compliance training, and functional responsibilities. Oracle staff must use a multifactor authentication process. Oracle also provides annual awareness training for selected personnel who support certain environments.

Segregation

Customer instances are logically segregated within B2C Service. Each customer’s instance is deployed on its own database schema. Oracle also protects each instance by not allowing any direct database access. Customer connections to data within B2C Service are through standard application program interfaces (APIs).

Cryptography

Oracle implements industry tested and recognized cryptography technologies to protect the continued integrity and confidentiality of sensitive information. We have developed encryption requirements that are based on National Institute of Standards and Technology (NIST) and Federal Information Processing Standard (FIPS) 140 and 180 guidelines. We also employ SHA-256 to protect passwords.

All file systems are encrypted to protect customer data at rest. This includes all files attached to objects in the B2C Service, all reports published to files, and all B2C Service instance databases, including database backups.

Secure Protocols

By default, all connectivity to B2C Service employs encrypted methods. While standard commercial customers can disable this encryption, Oracle does not advise this. For customers within regulated environments, Oracle strongly recommends HTTPS using TLS 1.2.

Masked Data

PCI regulated environments require that specific types of data be obfuscated from unauthorized people. Oracle employs technology that obfuscates payment account numbers (PAN) and U.S. social security numbers. Data of these types are rendered unreadable on the user’s display by automatically substituting all digits with asterisks.

The Luhn algorithm is used to obfuscate credit card (PAN) data. A pre-defined pattern check is used for social security numbers (nine digits separated by dashes, periods or spaces in the sequence of [3, 2, 4]). PANs and social security numbers are also masked when using APIs to retrieve information, and in file attachments that are downloaded from PCI environments as long as the file is text-based and not an image, zip, or binary file type.