Personal data in Exponential #

This page is for site owners, data protection officers and administrators who need a map of where personal data is kept in an Exponential installation. You cannot protect, export or delete data you have not found. Each row below was checked against the database schema (kernel/sql/mysql/kernel_schema.sql, the cjw_newsletter schema) and the documentation named.

Contents #

1. The map at a glance
2. Accounts and sign-in
3. Store: baskets and orders
4. Forms: the information collector
5. Mail preferences and newsletters
6. Logs and the audit trail
7. Everything else to check
8. Building your own data inventory

The map at a glance #

Accounts and sign-in #

• The account is a row in ezuser (login, e-mail address, password hash) tied to a content object of the user class, which holds the name and any other fields your class defines. Passwords are stored as bcrypt hashes (Security hardening).
• Activity: ezuservisit keeps the last visit, the number of sign-ins and failed attempts; Users > Check user accounts reads it (Check user accounts).
• Keys: activation keys and password reset keys have their own tables (ezuser_accountkey, ezforgot_password).
• Two-step sign-in: the authenticator secret is stored with the user; a SecretKey encrypts it in the database (Two-step sign-in).
• Removal: a user object never goes to the trash; removing it is final. Removing an account also erases its mail preferences (Check user accounts, Compliance and GDPR).

Store: baskets and orders #

• ezorder keeps the customer's e-mail address and user id, and, in its account record, the first and last name, e-mail address, street, ZIP code, city, state, country, phone and comment entered at checkout (kernel/private/classes/views/shop/userregister.php).
• ezbasket ties a basket to a session; ezwishlist to a user.
• Orders can be archived and removed in the administration (shop/archiveorder, shop/removeorder, Basket, checkout and orders). Your bookkeeping duties may require keeping orders for a period; decide with your accountant.
• Card data: the audit trail records payments "never card data" (The audit trail); see Card payments and PCI basics.

Forms: the information collector #

Each time a visitor sends a form, one collection is stored with one value per collector field. Setup > Collected information lists, exports (CSV) and removes collections; it needs the policy infocollector/read. Each export is recorded in the audit trail with the number of rows, never the values (Collected information). Mail to a receiver puts the same data in an inbox as well (Forms with the information collector).

Mail preferences and newsletters #

• The kernel's mail gate keeps each person's choices, a consent log and a suppression list stored as salted hashes (Consent and forms).
• The newsletter extension cjw_newsletter keeps its own subscriber records (cjwnl_user) with the fields listed above, subscriptions per list, and a blacklist with address and hash. Open and click tracking is off by default ([TrackingSettings] Tracking=disabled) (Compliance and GDPR).

Logs and the audit trail #

• 404.log and security.log mask client addresses by default (MaskIP=enabled); the log viewer masks e-mail addresses, IP addresses and secrets in what it shows (Compliance and GDPR).
• Velocity's access log is in Apache's combined format and "names visitors"; its files are readable by the owner and group only (same source).
• The audit trail truncates addresses, hashes sessions, shortens user agents, and never records passwords, tokens or secrets (The audit trail).
• Web server, mail server and panel logs outside Exponential follow your host's settings.

Everything else to check #

• To do: Custom content classes with personal fields (members, staff profiles, comments, event sign-ups).
• To do: Content authorship: each object and version records its creator and owner.
• To do: Private messages, if ezpm is active (it adds inboxes and outboxes; composer.json description).
• To do: Exponential Intelligence, if switched on: which provider receives which text (expai).
• To do: Third-party services embedded by templates: fonts, maps, analytics, videos.
• To do: Exported files on staff computers.
• To do: Backups and their retention.

Building your own data inventory #

Copy this table into your record and fill it in per row:

DATA INVENTORY
Data | Purpose | Legal basis (ask your adviser) | Where stored | Who may see it | Retention | How deleted
-----|---------|--------------------------------|--------------|----------------|-----------|------------
User accounts      |  |  | ezuser + user objects |  |  |
Orders             |  |  | ezorder               |  |  |
Form submissions   |  |  | ezinfocollection      |  |  |
Mail consent       |  |  | expmail_*             |  |  |
Newsletter         |  |  | cjwnl_*               |  |  |
Logs               |  |  | var/<site>/log        |  |  |
Audit trail        |  |  | var/<site>/log/audit  |  |  |
Backups            |  |  | (host)                |  |  |

Related pages #

• GDPR basics
• Data retention and deletion
• Form submissions
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.