Answers.Body: <p>This is such an interesting question - because I don't believe many users/owners realise that access to databases is absolutely required for support, or how security is exposed.  However, the simple answer is that normally whoever has access has to sign some kind of non-disclosure agreement that's suitably worded. The NDAs I've signed were not really up to the job, so the owners have relied on trust.  Which won't always work, of course.
  The other aspect that I don't think users/owners even realise is that the hosting company (if there is one) will also have complete access to databases and files.
  It wouldn't be feasible to restrict access as you describe though, at least not for CiviCRM.
  Full access is needed 100% for support, but in my experience isn't properly dealt with in terms of agreements etc.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-12-10T20:37:20.250Z
Answers.Text: Yes, but what I'm trying to determine is if there would be interest in limiting access to some records or some fields, even from "full access" individuals, if there was a way to do it. Of course, someone would need complete access, but I'm exploring a way to essentially hide some records or fields from people who may even have direct access to the database for development or maintenance purposes.
Answers.UserDisplayName: Jason
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-12-11T09:10:10.687Z
Answers.Text: In my experience (a rather long one) to limit access would be unrealistic & impractical.   Maybe this subject is more suitable for chat rather than Q & A?
Answers.UserDisplayName: Andy Clark
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-12-03T09:06:02.377Z
Answers.LastActivityDate: 2022-12-03T09:06:02.377Z
Answers.UserDisplayName: Andy Clark
Body: <p>I'm a CS grad student and curious about the security of the database beyond what is provided by the CiviCRM application. For example, the ACL can be used for more detailed access through the application but is bypassed if a developer has access to the database directly.</p>
  <p>My interest stems from my own experience supporting CiviCRM in the past. The IT people had full access to the database which held data about people that could not be leaked.</p>
  <p>I'd like to know if such security is an issue for any organizations using CiviCRM. Is it considered OK to allow developers or IT people to access the database fully, or would there be any demand for security that could protect certain tables, fields, or rows of data even from someone with direct database access?</p>
  
Tags: <database><security>
Title: Database security
ThreadText: # Database security
  
  (Asked by: username_0 on 2022-12-03)
  
  I'm a CS grad student and curious about the security of the database beyond what is provided by the CiviCRM application. For example, the ACL can be used for more detailed access through the application but is bypassed if a developer has access to the database directly.
  
  My interest stems from my own experience supporting CiviCRM in the past. The IT people had full access to the database which held data about people that could not be leaked.
  
  I'd like to know if such security is an issue for any organizations using CiviCRM. Is it considered OK to allow developers or IT people to access the database fully, or would there be any demand for security that could protect certain tables, fields, or rows of data even from someone with direct database access?
  
  **Tags:** database, security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2022-12-03. Score: 2
  
  This is such an interesting question - because I don't believe many users/owners realise that access to databases is absolutely required for support, or how security is exposed. However, the simple answer is that normally whoever has access has to sign some kind of non-disclosure agreement that's suitably worded. The NDAs I've signed were not really up to the job, so the owners have relied on trust. Which won't always work, of course.
  The other aspect that I don't think users/owners even realise is that the hosting company (if there is one) will also have complete access to databases and files.
  It wouldn't be feasible to restrict access as you describe though, at least not for CiviCRM.
  Full access is needed 100% for support, but in my experience isn't properly dealt with in terms of agreements etc.
  
  > **Comments:**
  > **username_0**: Yes, but what I'm trying to determine is if there would be interest in limiting access to some records or some fields, even from "full access" individuals, if there was a way to do it. Of course, someone would need complete access, but I'm exploring a way to essentially hide some records or fields from people who may even have direct access to the database for development or maintenance purposes.  
  > **username_1**: In my experience (a rather long one) to limit access would be unrealistic & impractical.   Maybe this subject is more suitable for chat rather than Q & A?  
  
  ---
  
  