MinSec Check: SaaS/PaaS: Data Management

[akkornel]

In MinSec for SaaS/PaaS, the Data Management item has the following:

Contractually ensure that Stanford data is purged upon termination of the agreement.

[akkornel]

This is kindof confusing, because of the nature of Globus subscriptions.

Even if we do not have a contractual relationship with Globus, people at Stanford would still be able to use Globus for the following things:

• Have Globus Connect Server (GCS) endpoints, without Shared Endpoint support. In other words, a sysadmin could set up an endpoint where anyone with a local account can do transfers under their control, but those people would not have the ability to share those local files with other people (that is, people who do not have an account).

• Globus Connect Personal endpoints, without Globus Plus support. This lets a user put a Globus endpoint on their own endpoint, but does not give them the ability to share stuff on their endpoint with other people.

It's worth noting Slide 5 from the Globus World 2019 Keynote shows how the majority of endpoints out in the world are not covered under a subscription, which means there is no contractual agreement with Globus, beyond whatever click-through Ts&Cs exist.

As a parallel example, consider something like Dropbox: If a group is paying for Dropbox, but then stops paying; that group may continue using Dropbox, just with a much-smaller quota.

So, this requirement may not apply, as we would be allowed to continue using the service (at least, part of the service) even if we did not have a subscription.