InCountry overview for developers and DevOps - InCountry

InCountry Cookies Policy

InCountry uses data collected by cookies and JavaScript to improve your browsing experience, analyze site traffic, personalize content, and increase the overall performance of our site.

We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below.

Necessary

Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.

Functional

Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.

Analytics

Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.

Performance

Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.

No cookies to display.

Advertisement

Advertisement cookies are used to provide visitors with customized advertisements based on the pages you visited previously and to analyze the effectiveness of the ad campaigns.

Uncategorized

Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.

No cookies to display.

Developer overview

Fully isolate regulated data in separate countries and manage anonymized cross-border data transfers

Developers and developer operations (DevOps) can fully isolate regulated data InCountry’s no-code Web Services Proxy, REST APIs, and deep edge services:

Transform web services on the fly with no code.

Direct existing REST web services through InCountry’s Web Services Proxy in a country to dynamically redact, anonymize, and reinsert regulated data for CRUD operations, search, and more. Easily anonymize cross-border data transfers to central data stores and applications.

Use a REST API to directly manage regulated data.

Call InCountry’s REST API from either clients or servers to directly manage regulated data in a country for CRUD operations, search, reporting, and more. Then use your existing APIs to send anonymized data to central data stores and applications.

Isolate regulated data globally with vaults and deep edge services.

InCountry’s secure vaults manage regulated data with two active-active points of presence in each country and deep edge services for file management, reporting, threaded e-mail, and more.

Architecture

Each InCountry point-of-presence offers secure infrastructure for an application front-end and back-end to fully isolate data within a country:

Features

Vault

The InCountry Vault is the core of InCountry’s data residency solution. The vault offers:

Web Services Proxy

InCountry’s Web Services service enables codeless redaction and re-insertion of regulated data for existing web services. Create, Read, Update, and Delete operations are all supported by the Web Services editor in the InCountry Portal. Each redacted field can be assigned a variety of tokenization and encryption techniques. Data can also be masked algorithmically for export outside a country.

The Web Services Proxy can also perform and respond to a typical Search URL and match the format of an app’s existing search results.

An additional feature of the Web Services Proxy is anonymized cross-border data transfers that do not require storage. This is useful for use cases such as ETL and syncing between the local instance of an app and the global instance of an app.

Learn more about Web Services Proxy

REST API

InCountry’s REST API is a straightforward API that can be called from either an application front-end or back-end. The REST API is familiar and easy-to-use and supports Create, Read, Update, and Delete (CRUD) operations. In addition, the REST API supports detailed search, aggregate analytics, file management, and calling resident functions.

The REST API supports policy-based access control with query filters and field masks, as well as fine-grained access control by querying a system of record back-end application for the rows and fields a user can access.

Learn More about REST API

Data Firewall

The InCountry Data Firewall ensures that data remains within a geographic boundary and only encrypted data or aggregate data can cross borders. The solution verifies IP addresses are within a country, invalidates existing VPN IP addresses, and confirms user permissions.

The Data Firewall also performs data loss prevention with an AI model for each source country to detect PII in the country’s native language(s), including names, addresses, and identity numbers.

Learn More about Data Firewall

Encryption & Tokenization

InCountry provides a variety of masking, tokenization, and hashing options so that cross-border data can be anonymized. Masking is accomplished with both templates and regular expressions for complex masking requirements. Generated tokens can match existing data structures and also be deterministic, where the same token is generated every time for a specific origin value. A variety of hashing options are also available.

Within the InCountry Vault, fields can be stored as a deterministic SHA-256 hash that is fully searchable, while corresponding values are stored with AES-256 encryption.

Learn more about Encryption & Tokenization

Identity & Authorization

For highly regulated environments, user, employee, and customer PII can be managed within InCountry and the global Identity Provider contains masked user names and e-mail addresses. The source application and identity provider specify what countries a user can access.

User authorization to data can be both policy-based and fine-grained. InCountry access policies can contain query filters, control over read/write/delete functions, and limit fields accessed. In addition, masking templates can be set at the field level. For example, an access policy for a marketing team outside of a country can be set to records less than 30 days old, read-only access, and identifying fields masked with asterisks.

Fine-grained authorization for individual record and fields is enabled by using an API to an existing back-end application to filter result sets.

Learn more about Identity & Authorization

CRUD

With records at its core, InCountry provides comprehensive support for (CRUD) Create, Read, Update, and Delete operations. CRUD operations can be performed by developers with the InCountry REST API from the front-end or back-end. Developer operations (DevOps) can implement the Web Services Proxy to dynamically redact, anonymize, and reinsert regulated data for CRUD operations.

Creating and updating records automatically returns anonymized values that can be used by an application. The anonymized values can be masked values, format-preserving, hashes, or deterministic tokens.

Learn More about CRUD

Search

InCountry can match your existing web services search endpoint, and then perform the search locally within the InCountry Vault. The data stored within a country can also be extended with unregulated data that is replicated in order to perform more efficient searches. For example, if First Name and Last Name are regulated and stored within a country, but City is not, InCountry can still perform a search for Last Name = “Han” and City = “Beijing”.

The proposed results are then authorized by your application to ensure that the current user is authorized to view the records and the individual fields within each record. The results are then returned using the same JSON format your existing search web service uses to return search results.

Learn more about Search

Analytics

InCountry supports both reporting of detailed regulated data within a country, and reporting of aggregated and anonymized data outside a country.

Detailed analytics within a country can combine regulated data and unregulated data, with filtering, grouping, and aggregation. Your application can continue to provide drill-down functionality and users can use data they are authorized to see. For example, a Sales Manager can see the total pipeline amount by city and drill down and see each prospect.

Aggregate analytics outside a country uses InCountry’s aggregation functions so that reports running outside a country can provide aggregates of regulated data. For example, a Sales Manager can see the total pipeline amount by city but cannot drill down and see each prospect.

AI

Data from InCountry vaults in multiple countries can be fed into a single global LLM using field-level anonymization techniques. Data fields like first and last names can be anonymized, and the LLM subsequently tokenizes the anonymized data. The LLM can then perform on a global data set, and LLM users do not have visibility into regulated data fields.

For AI insights operating directly on local data in a country, an LLM can be deployed fully within a country as a container and integrates data directly from the InCountry Vault in each country. To maintain data loss prevention in each country, the data fed into the LLM can be masked, or the container can be purged after performing its duties.

Functions

InCountry provides serverless functions so that code can be executed on regulated data. Use cases include validating values and performing calculations. The code execution is fully sandboxed and isolated to prevent data loss. Currently, InCountry functions support JavaScript, and existing code can be easily translated using AI code transformation.

Learn more about Functions

E-mail

InCountry’s e-mail service makes it possible to run global applications that do not have visibility into user e-mail addresses, names and other PII. The InCountry e-mail server can redact and unredact sensitive data from both outbound and inbound e-mails.

For outbound e-mails, e-mails with hashed e-mail addresses are sent to the InCountry SMTP with the target country, where actual e-mail addresses and other PII are inserted into the e-mail, and then it is sent on within the country. For inbound e-mails, the service captures e-mails and can redact e-mail addresses and other PII and replaces the values with hashed values so that regulated data does not leave a country.

Learn more about E-mail

Files

The InCountry Files service supports small files <15MB as standard HTTP attachments and large files with a REST API similar to S3. Files must be attached to a primary record in order to prevent orphaned data and support compliance requests.

Learn more about Files

Payments

The InCountry Payments service is a fully PCI DSS compliant solution that is fully localized in each country and can work with a different designated payment processor for each country. Your application does not need to attain PCI DSS compliance but can still maintain independence from payment processors and switch processors as needed by business requirements, without disrupting customer saved credit card numbers or recurring payments.

Learn more about Payments

The enterprise-grade solution for data residency and data sovereignty

Enterprise Ready

Bank-Grade Security

Global Compliance