Securing your data in IBM Cloud Logs

To ensure that you can securely manage your data when you use IBM Cloud Logs, it is important to know exactly what data is stored and encrypted and how you can delete it.

How is data stored and encrypted when using IBM Cloud Logs

IBM Cloud Logs manages two types of data on behalf of customers: configuration data, also known as metadata, and log data.

Configuration data

Configuration data includes the following information:

Instance level preferences information

For more information, see Configuring your account preferences.
User preferences information
Configuration data of features such as view, alerts, parsing rules, dashboards, and TCO policies.

Configuration data is encrypted using service-managed encryption.

Log data

Log data can come from many sources: agents, IBM Cloud services, APIs, and so on.

IBM Cloud Logs is not designed for the storage or transmission of sensitive or confidential information. Personal data, credentials, or any sensitive content should not be included in data sent to IBM Cloud Logs.

Users can configure TCO policies to manage how their log data is processed in an IBM Cloud Logs instance.

Logs configured to the Priority insights data pipeline are retained by IBM Cloud Logs for a limited duration that is determined by the instance plan level and protected using a service-managed encryption key .

If the instance has a IBM Cloud® Object Storage (COS) bucket attached, all of the data which is sent to Priority insights is also stored in the COS bucket. The retention or deletion of the data in the bucket is controlled by the COS bucket configuration that you define.
Logs configured to the Analyze and alert or the Store and search data pipeline store the data in the COS bucket that is attached to the instance. The retention or deletion of the data in the bucket is controlled by the COS bucket configuration that you define.

Users can control the data that is ingested and is available for search in IBM Cloud Logs by using any of the following methods:

Configuring the logging agent to include and exclude information that is sent to an IBM Cloud Logs instance.

For more information, see Configuring what logs are included or excluded in an orchestrated environment and Configuring what logs are included or excluded in a Linux environment.
Controlling data ingested for search in IBM Cloud Logs.

Users can drop data during ingestion by using TCO policies or by using parsing rules.

Protecting log data in IBM Cloud Logs

The type of encryption that is used with log data depends on how IBM Cloud Logs is configured to process the data.

Data processed in motion by IBM Cloud Logs is done using service-managed encryption.
Data stored at rest with Priority insights is managed with service-managed encryption.
Data stored at rest in an IBM Cloud® Object Storage (COS) bucket can be managed with customer-managed encryption.

Data stored in IBM Cloud® Object Storage is a copy of the data in Priority insights and the data retained in Analyze and alert and Store and search.

IBM Cloud Logs supports server-side encryption (SSE) per bucket.

For more information, see Server-Side Encryption with IBM Key Protect (SSE-KP).

Log data managed in an IBM Cloud® Object Storage (COS) bucket supports the bring your own key method allowing you to meet the data control requirements if you need this level of assurance. Follow IBM Cloud® Object Storage (COS) bucket configuration guidance. For more information, see:

If your data must be protected by using a customer-managed encryption key, configure TCO policies to exclusively process data through the Analyze and alert or Store and search data pipelines. For more information, see Configuring the TCO Optimizer.

Deleting your data in IBM Cloud Logs

When you delete your IBM Cloud Logs instance, all of the user data that is associated with the instance is also deleted. When the instance is deleted, a 7-day reclamation period begins. During that time, you are able to restore the instance and all of its associated user data. However, if the instance and data are permanently deleted, it can no longer be restored.

Deleting the IBM Cloud Logs instance

If you no longer need an instance of IBM Cloud Logs, you can delete the instance and any data that is stored. Once the instance is deleted, you will no longer have access to it. The instance will remain in the pending reclamation phase for 7 days. If you choose to reclaim the instance within this period, you can initiate the reclamation process. See Removing an instance for the steps to delete an instance.

Restoring deleted data for IBM Cloud Logs

When an IBM Cloud Logs instance is deleted, it is put in a suspend state for 7 days after which its removed from the IBM Cloud. If the instance is reclaimed and re-enabled, you can regain access to data.

Consider the following information in regards to the data that is reclaimed:

Data retention in Priority insights depends on the service plan configured for the instance. Therefore, you can only regain access that is available based on the service plan.
Data in the bucket that is attached to the IBM Cloud Logs instance is available as long as the data is available in the bucket.

If the instance is not reclaimed within the 7-day pending reclamation period, the data will be permanently deleted within 90 days. See Recovering a deleted instance for the steps to recover an IBM Cloud Logs instance.