1. Securing B2C Service
  2. Analytics Security

Analytics Security

Use care regarding permissions and accessibility of reports, including data in a report being exported to another system outside of the B2C Service.

B2C Service has a rich set of analytics features for reporting on data within a customer instance. It is your responsibility to manage what reports remain published and which staff members have access to selected reports.

Exercise caution when distributing reports using email. When reports are scheduled to automatically be emailed to a person or group, in a PCI environment, PAN and social security numbers saved in the database could appear on these reports without being obfuscated. Additionally, if an agent chooses to forward a report using the email functionality, the report contents will not be subject to masking.

When using the Report Caching feature, where an often executed report is created automatically at a set interval, you should put an appropriate process in place to disable a cached report when it is not needed as frequently.

For HIPAA customers, there may be a concern that analytics could expose PHI from the incident thread. There is a setting that prevents analytics from having access to the threads.note field, which is where PHI should be persisted. To enable this feature for a customer instance, the THREADS_NOTE_ANALYTICS_VISIBLE configuration setting is automatically enabled for a HIPAA customer site. This setting provides assurance that threads.note is not permitted to be included on a custom report.

Note: This setting prevents customers from running any reports that contain this field. Some standard B2C Service reports will produce an error for HIPAA instances or any time THREADS_NOTE_ANALYTICS_VISIBLE is enabled. These reports are:

  • Incident Details By Survey (/Public Reports/Feedback/Service Surveys)

  • Email Response (/Public Reports/Service/Email Reports)

  • Incident Message Transactions (/Public Reports/Service/Views - Service/Editor Reports – Service)

The error you'll see is Invalid reference to threads note. Your site is not configured to allow reporting on thread note. You will need to edit the report to resolve these errors.