# Data Access and Privacy

> Learn how Ours Privacy securely handles data, supports HIPAA programs with a signed BAA, and lets you customize data access for destinations.

Source: https://docs.oursprivacy.com/docs/data-access-and-privacy

Ours Privacy is built with privacy-forward principles, so your data is securely handled and configurable to meet your privacy requirements. You control what data is shared with each destination.

***

## Key Privacy Features

Ours Privacy provides several privacy-focused features that help you handle data securely and support HIPAA programs:

1. **Data Redaction and Hashing**:
   * Configure each destination mapping to hash, redact, or omit the fields it receives.
2. **Customizable Privacy Rules**:
   * You can configure how data is handled for each destination, including which fields to redact, hash, or omit.
3. **Exportable Mappings**:
   * Export default or custom data mappings from the **Destinations Data Mapper** page. This allows you to share configurations with your team for review or compliance validation.
4. **Access Transparency**:
   * View and audit data being sent to destinations through the [Recent Events Dashboard](https://docs.oursprivacy.com/docs/tracking-and-debugging-events).
5. **Signed Compliance Agreements**:
   * Ours Privacy signs Business Associate Agreements (BAAs) with healthcare organizations.

***

## Viewing and Configuring Data Access

Ours Privacy provides tools to review how your data is shared with destinations and customize it as needed.

### Viewing Default Destination Mappers

To see how data is mapped and sent to destinations:

1. Go to the **Destinations** section in your dashboard.
2. Select a destination and navigate to the **Mappings** tab.
3. View the default mappings for each field, including any modifications (e.g., `Hash`, `Redacted`).

This view is useful for compliance teams to verify:

* **Which data is shared**: Ensure no unnecessary Personally Identifiable Information (PII) or Protected Health Information (PHI) is included.
* **How data is handled**: Confirm hashing or redaction rules for sensitive data.

![The Analytics Workspace default mapping with visitor email hashed and visitor phone redacted before the destination receives the event](https://docs.oursprivacy.com/img/data-access-and-privacy/data-access-and-privacy-img-1.jpg)

### Exporting Mappings

You can export your mappings (default or customized) directly from the **Mappings** tab for any destination:

1. Go to the **Mappings** tab in your destination configuration.
2. Click the **Export** button to download the mappings in a shareable format (e.g., CSV or JSON).
3. Share the exported file with your team or compliance department for review.

***

## Privacy Configurations for Destinations

Each destination in Ours Privacy allows you to configure privacy settings for data properties. These settings include:

### Hashing

* Transforms a value into a hash.
* Use it when a destination expects a hashed identifier, such as an email address or phone number.

### Redaction

* Replaces sensitive data with `"REDACTED"`, ensuring no sensitive information is shared with the destination.

### Exclusion

* Omits specific fields entirely from being sent to destinations. Use the `$ignore` directive in the mapping configuration.

### Custom Transformations

* Apply advanced rules to modify data before it’s sent. For example:
  * Extract only the domain from a URL (`DomainOnly`).
  * Remove URL parameters (`FullUrl`).

***

## Accessing Data in Ours Privacy

### Recent Events Dashboard

The **Recent Events Dashboard** provides a detailed view of every event tracked in Ours Privacy. You can inspect:

* Event properties.
* Visitor properties (hashed or redacted as configured).
* Destination-specific data.

Use this dashboard to:

* Debug data flows and mappings.
* Confirm privacy rules are applied correctly.
* Audit what data is being shared with destinations.

***

## Compliance and Security

Ours Privacy protects your data with the following:

### HIPAA Compliance

Ours Privacy offers signed BAAs for healthcare organizations. Configure and validate each destination mapping before data is dispatched.

### Secure Data Storage

All data in Ours Privacy is encrypted at rest and in transit, ensuring it remains secure throughout its lifecycle.

***

## Sensitive Data in URLs

The Web SDK captures `current_url` and `referrer` as standard event properties. **You are responsible for ensuring authentication tokens, session identifiers, password reset codes, and other secrets are not placed in your URLs**, including in query strings (`?access_token=...`) and hash fragments (`#access_token=...`, `#/path?token=...`), which OAuth and single-page-app routing commonly use.

If your application places sensitive values in URL query parameters or query-like hash fragments, the Web SDK accepts a `url_query_params_blocklist` option that strips configured parameter names from captured `current_url` and `referrer` values in both the query string and the hash fragment before events are sent. See [`url_query_params_blocklist` in the Web SDK reference](https://docs.oursprivacy.com/docs/web-sdk-javascript#url-query-params-blocklist-url_query_params_blocklist).

***

## Best Practices for Privacy Management

1. **Audit Destination Mappers**:
   * Regularly review destination mappings to ensure sensitive data is handled appropriately.
2. **Limit Sensitive Data**:
   * Only send necessary data to destinations. Use `$ignore` or redaction where possible.
3. **Use Hashing When Required**:
   * Select `Hash` when a destination expects a hashed identifier.
4. **Test Your Configuration**:
   * Verify data privacy rules in the [Recent Events Dashboard](https://docs.oursprivacy.com/docs/tracking-and-debugging-events).
5. **Share Mappings with Teams**:
   * Export mappings and share them with your compliance team for validation.
6. **Align with Compliance Teams**:
   * Share the default mapper configuration with your compliance team for validation.

***

## Next Steps

* Review your destination configurations in the [Destinations Overview](https://docs.oursprivacy.com/docs/destination-overview).
* Explore [Data Mapping](https://docs.oursprivacy.com/docs/data-mapping) to customize property handling.
* Use the [Recent Events Dashboard](https://docs.oursprivacy.com/docs/tracking-and-debugging-events) to audit your data flows.