PII: Personally Identifiable Information. Information that can be used on its own or with other information to identify, contact or locate a single person or identify an individual in context.
Digitalfire Corporation is the owner of Insight-live.com. Digitalfire.com hosts a large reference database of technical information for traditional ceramics technicians and engineers. Insight-live.com provides a working environment where users store their recipe, photo and testing records. The two sites are hosted on the same server and store data in an SQL database. They both have the ability to read the database.
We recognize that server security is a key factor in protecting personal data and make every effort to secure the information. Anything users enter into their accounts is treated as data at a bank, no one else can see it.
Security is a very complex issue, not something that can be added on to an existing web site. We created, control and understand every line of program code. We designed from the ground up with security in mind. We having developed practices that minimize risk.
A key principle in software design is: functionality is the enemy of security. The more things it can do, the more levels on which it is built, the bigger it is; the more the potential number of security holes there are to be discovered. Our philosophy is thus one of starting with simplicity, only having the minimum of what is needed to get the job done. Then adding features in a controlled fashion. This principle guides us. Our servers also are Linux, the proven best platform, and they are configured from ground up by us, to have an absolute minimum of packages installed and very few ports exposed to the internet.
Login and Accounts
Insight-live partitions data from each account such that users (or user groups) can only see their own data. Safeguards are in place to prevent users from circumventing the partition mechanisms.
When users save a password on their insight-live account page, it is encrypted, even we have no way to retrieve it, they must reset it to regain access.
Our sites do not exist for the purpose of collecting data and monetizing it. We provide an environment that users log in to to create and upload data into their accounts. The environment is sufficiently flexible that users can store and upload a wide range of data types. This data can include personal information and trade secrets.
When users create an account they only supply an email address. This enables them to sign up for our monthly email newsletter without providing any further information. If they choose to subscribe to our online data management services, they must provide sufficient address information to satisfy the payment processor (street, city, postal code). Our sites do not store or even even see payment card details.
Insight-live collects the following data:
Digitalfire.com does not collect any data.
We process all sales through PayPal (which works whether you have a paypal account or not), no payment information is ever known or stored by Insight-Live.
Contacting Users: We contact users by email. This may be needed to remind them about security practices (e.g. encrypting a password), about conservation of server resources (e.g. avoiding excessive storage requirements by cropping, resampling photos) or about how to reset their password (if we note they are having issues logging in).
Contact Form: Users who contact us about technical problems often reveal trade secrets. We carefully guard these communications and delete them after finished. To give better personalized service we make notes in users accounts (in an area they cannot see) regarding the types of problems they have experienced.
Tech-Tip Newsletter: We send these out monthly using the emails users provide us.
Handling Payments: Our payment processor requires that we give them the clients address. Clients can edit this in their account page. We do not share this with anyone. We do not see or store any kind of payment information.
Registration and Authentication: The registration and login pages on our website receive particular attention to harden them against infiltration. We monitor live hacker attempts to enter and adjust our strategy accordingly.
Encrypted passwords: We entrust you with the ability to encrypt your password.
Frequent server updates: As server vulnerabilities become known they are one of the key vectors for infiltration. We update server software weekly and as bulletins surface. We monitor industry security news, social networks and podcasts by authorities to be aware of these.
Backup Servers: Daily, weekly and monthly automatic backups are made by remote mirror servers that link via SSL.
Server Credentials: Backup servers have different credentials. Servers do not have root accounts and can only be accessed using RSA public/private key pairs. We guard these keys on the machines of code developers and administrators.
Subcontractors: These are never allowed access to our main server. They work on backup servers that have different credentials. Even then, no contractor is given access to a backup server unless we have experience with his/her work and ethics.
Monitoring: We are constantly monitoring all failed logins, unusual login attempts, file changes/adds/deletes, server and database error conditions, account creations, unusual changes in database records. We can block an IP address quickly to prevent all access.
Disaster plan: Documents describing the complete functioning of our system are entrusted with Plainsman Clays in Medicine Hat, Alberta, Canada.
Data is resident in a database on a dedicated server managed by Codero.com in Phoenix, AZ (we have a long relationship with them). All processing of the data happens on the server by automated systems that we design. Software tools that we use to edit data manually, when necessary, reside on the server and present their HTML interface through a web browser via SSL in authenticated sessions. No subcontractors or workers download data, process it, and upload it.
The names and contact information of clients are maintained as long as they are active in our system. When they stop subscribing and stop opening our emails we gradually purge their information completely. However if they have R&D data stored in our system we do not purge until we have their permission.
We do not analyze and data-mine (using AI or programmatic methods) the R&D data that clients create in our online system. We do not target them for any promotions and do not reveal anything about their data to outside vendors.
Opt-in members at https://insight-live.com are sent a monthly email that draws from the content at https://digitalfire.com. The email address is stored at insight-live.com as part of its membership information. The email is sent from digitalfire.com (since both sites are on the same server, it has access to the people database at insight-live.com). Our dispatching system is sensitive to the "subscribe" setting which the user controls on his/her account page and during signup. During the unsubscribe process users are not redirected anywhere, they go straight to the unsubscribe page that does one thing: Marks their account as unsubscribed. We manage bounce-backs from monthly mail-outs manually to maintain a high-quality member list.
Monthly emails also inform members of their account status as appropriate and give them a one-time-login link. They also provide a link to see that specific tip at digitalfire.com within its context in the library.
Personal Data collected: Nothing is collected at Digitalfire.com.
CAN SPAM Act
The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.
To be in accordance with CANSPAM, we agree to the following:
*We do not send out advertisements.
The content at digitalfire.com is built on constant contact with ceramic technicians around the world. The arrangement is based on trust and the fact that the online Digitalfire Reference Library database is open and free to all. Digitalfire.com is on the same server as Insight-live.com and has access to its membership database. That database includes extensive information on member expertise, needs and willingness to share. Our staff engages in email correspondence with members according to this knowledge, and often unprompted email is sent to members and contacts based on this history.
These are found on almost every page of our sites (thousands of pages). They prompt visitors to ask technical questions about ceramics or the use of our products. These are not sent via email, they are added to a message queue in a database table on the server. Our staff checks the message stream each day. We respond via email and delete the original requests permanently (no log is kept). However, we continue conversions via email when people respond. Email is done using a Google Apps-for-Business account. The audit trails of these messages are trashed and google's automatic deletion occurs a month after that.
Insight-live.com attempts to write a test cookie into your browser on the first page view. If it succeeds in reading it back on the second view it realizes your browser accepts cookies and continues. If not it warns you that the site will not operate without them.
When you log in the insight-live server creates a cookie in your browser having unique 10-character code that identifies your account. After that, it asks for that code every time your browser connects, and if received, logs you in automatically to that account.
Insight-live does not permit any third-party advertising or tracking in its pages. Thus there are no third-party cookies and nothing you do at our websites will be known by others.
Digitalfire.com does not use cookies.
Our systems create text-file logs to assist troubleshooting problems with orders, flag programming errors. However these logs are viewable by staff only and routinely erased (we have no permanent log storage). We also do not maintain a history of email contact with users.
Insight-live.com logs failed logon attempts, password resets, unsubscribes, subscribes and account sign-ups. These go into short-term storage in a database. As our staff notes them on a control panel they are removed permanently. However the system does log page visits and IP addresses and connects these to user accounts. This is done to give us a way to notice unusual account activity. Visits are not individually logged, they are tallied to a total number between between two dates.
Pages load quickly because we do not permit any third-party trackers or analytics scripts to bounce you around before the page displays. There are no third-party javascripts that continue to run after page load. We are among very very few sites on the internet that are not tracking you for advertising or other purposes.
Since we permit no tracking that means there is no there to handle do-not-track signals.
We are very cautious about adopting third-party software tools. We do not use a content management system or Flash video. We only use proven open-source products that are cooperatively reviewed and hardened by communities of hundreds of thousands or even millions of users.
The code in these systems is automatically kept up-to-date using dependency managers.
Do do not market to children and they normally do not use any of our services. Our system does not record the age of users.
Our email contact system has the capacity to reach all users in one 24-hour day. We have built in the capacity to author and dispatch a message in minutes. We will take the following responsive action if a data breach occurs:
All of the login and user pages on insight-live.com have contact forms. These are available to anyone. Messages go directly to our job-queue, not to email. These demand our attention and get quicker response than email. Notwithstanding that, you can email us at tony@digitalfire.com.