Datastore for combined Engage Products

[ChinmayNanavati]

There is a natural synergy between Engage for Vendor (E4V) and Engage for Business Users (E4BU) products. Therefore, combining them into a single deployment will simplify integration with Archer and make ongoing administration and content monitoring efficient. In addition, the end-users needing to work on both products will also benefit from having a single access point to manage their work. Therefore, after review and deliberation, we are moving to a single data store to save the data for both Engage products with a logical separation to limit the access.  

This design will not compromise the data security, as the Engage product portfolio design naturally supports content security through multiple controls:

1. Administrators or Risk Managers explicitly publish data to Engage, limiting the available data in Engage at any time.
2. The Engage datastore retains the published data for a limited time (default set to 180 days).
3. A user can access the data only if Administrators or Risk Managers have expressly granted access to specific records while publishing from Archer to Engage, or when another approved user who has access to the record initiates the collaboration and is within a previously specified set of email domains.

However, we would like to get your thoughts. For example, if you use both Engage Products or plan to use both products in your organization, which security requirements, if any, within your company might limit your use of the products?

We look forward to your feedback through the comments section in this blog.

[JasmineWright]

My main concern with them being combined in the same datastore is that Engage for Vendors is being used for third parties external to our organization while Engage for Business Users is being used for internal users.  Naturally, you would be more comfortable storing data deemed sensitive in an area that you are sure can only be accessed by people within your internal organization.  With them being combined into the same datastore and being managed by a third party outside our organization, this move can definitely require our Information Security team to impose more rigorous security standards for Engage for Business Users than they would now since they are currently separated if we were to use both products just because mistakes can happen. I would at least recommend storing the data from the two separate products in separate tables within the same data store....and maybe adding that to the SOC2 for confirmation.  However, I understand the rationale and benefits for this change.

Something that should also be taken into consideration is how does this change affect existing customers using either or both of the products that are using Archer OnPremise.  What changes would they have to make on their side, if any, to make the product continue to function after the update?  Is it something they can easily do without having to pay Professional Services for assistance to continue using the product?