Encription

0

Hi Adrian,
We already have statement from Webcon on this topic from 2023 source here: https://community.webcon.com/forum/thread/75 I'm pasting response below.

"Do not expect that option as a standard in WEBCON BPS. We/you/Partner can do it as an SDK plugin. Why? Because is a lot of questions to answer every time any customer wants to implement such an option:
1. what is an encryption algorithm (symmetrical/asymmetrical).
2. Where encryption keys are stored?
3. What kind of encryption keys should we use? Password, individual password, certificate (what kind of certificate), hardware token etc...
4. What about the backup/restore procedure?
5. Do you want a disaster recovery scenario for encryption.
6. Is there a master key? Who stores such a key?
7. What about the DEV/TEST/PROD scenario?
8. Write your question here ...

We have made a few proof of concepts for our customers, but nobody has answered our questions :(
It is quite easy to implement as an SDK plugin but with a good project."

Hi Max,

I’m familiar with this topic, but back in 2023 the access authorization feature did not exist.

Please note that you cannot use SDK customization when the access authorization to form fields feature is enabled.

So even if you have the SDK prepared to encrypt data in fields, it cannot be used together with access authorization.
My idea is to allow using access authorization alongside the SDK, because both features are complementary.

Additionally, I strongly believe that native encryption in BPS is also achievable. For example, encryption keys could be created in a similar way to API secrets, with the ability to grant access to a business user. This would allow a business user to independently generate and store a secret. In such a setup, the business could protect sensitive data even from IT staff who have access to the database.