Data Transfer at Netskope

At Netskope, securing our customers’ cloud usage requires processing certain amounts of customer data through our platform. To ensure compliance with applicable data protection laws, we employ robust organizational and technical measures that prevent unauthorized or non-compliant data transfers. These measures ensure data is processed and stored in strict accordance with customer instructions and legal requirements.

Mechanisms Governing International Data Transfer Data Transfer Impact Assessments (DTIA) Data Sovereignty/Localization

Mechanisms Governing International Data Transfer

While customers, as data controllers, are responsible for conducting due diligence to ensure compliance with cross-border data transfer legislation, Netskope supports compliance by leveraging a range of organizational, legal, and technical safeguards. Importantly, Netskope does not rely solely on the European Commission’s adequacy decisions for data transfers. Even when transferring data to countries covered by adequacy decisions, we implement additional safeguards, such as Standard Contractual Clauses (SCCs) and other mechanisms, to enhance the protection of personal data. These safeguards also apply to data transfers involving non-adequacy decision countries.

Netskope undergoes annual SSAE 18 SOC 2 Type 2 attestation through an independent, third-party auditor, and has done so annually since the company launched in 2012. Additionally, Netskope has ISO 27001, ISO 27017, ISO 27018, CSA STAR, ENS (Spain), UK Cyber Essentials certifications, and C5 (German) attestations. These international standards outline best practices for information security management systems and the protection of personally identifiable information in the cloud.

Netskope can also provide a Data Processing Addendum (DPA), which includes the latest European Commission Standard Contractual Clauses (SCCs). Netskope’s DPA includes the UK addendum, and its SCCs have been approved by the European Commission. Netskope is obligated under the SCCs to notify its customers in the event it is made subject to a request for government access to customer personal data from a government authority. In the event that Netskope is legally prohibited from making such a disclosure, Netskope is contractually obligated to challenge such prohibition and seek a waiver. A copy of Netskope’s customer DPA can be found here: https://www.netskope.com/resources/data-sheets/netskope-data-processing-addendum

Netskope also ensures compliant cross-border data transfers by participating in, and certifying its compliance with, the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension of the EU-U.S. Data Privacy Framework. Whenever data is shared with Netskope’s sub-processors, Netskope will remain accountable for how it is used. Netskope requires all service providers to undergo a thorough cross-functional diligence process by subject-matter experts in our Security, Privacy, and Risk & Compliance Teams to ensure our customers’ personal data receives adequate protection. This process includes a review of the data Netskope plans to share with the service provider and the associated level of risk, the supplier’s security policies, measures, and third-party audits, and whether the supplier has a mature privacy program that respects the rights of data subjects. We provide a list of our sub-processors on our sub-processors page.

Netskope provides data security and privacy training to all of its staff. And Netskope has developed privacy policies based on privacy by design principles that we employ internally. Please refer to Netskope’s Privacy Policy for further information.

Together, these mechanisms give our customers confidence that any cross-border transfers of their data are aligned with applicable privacy legislation.

Data Transfer Impact Assessments (DTIA)

Netskope recommends customers perform their own DTIAs on their specific usage/deployment of the Netskope products and services.

Data Sovereignty/Localization

Netskope provides a number of technical mechanisms to support customers’ compliance with applicable data sovereignty or localization requirements. Processing of customer data and policy enforcement (in-line data processing) can occur in Netskope’s data centers, also known as data planes. For inline data processing, Netskope has a wide variety of regions (zones) that a customer can use to restrict where data in motion is processed. By default, all customers are configured to utilize all global data centers; however, customers can choose from other configurations for traffic management that best meet any geographical, legal, and jurisdictional requirements.

Some zones are specific to a given country, such as the United States Zone, the Germany Zone, the Brazil Zone, the Japan Zone, the Australia Zone, and so on. Other zones are defined by region, such as the European Union Zone, the North America Zone, the Latin America Zone, and the Africa Extended Zone, for example. Zones can even be defined by language, such as the English Language Zone and the Spanish Language Zone, which comprise all data planes in English and Spanish speaking countries, respectively.

Customers’ log transaction data are stored in the management plane designated by each customer. Currently, management planes are available in the United States, the EU, the UK, Australia, Saudi Arabia, Switzerland, and Singapore.

Netskope provides encryption at rest and in transit as well as offering customers a “bring your own key” option. Netskope does not store any customer end-user data (files or structured data), only log transaction data relating to the end-user cloud usage. Customer files and structured data are processed by Netskope in memory only and not persisted to storage media within our platform environment.

Netskope also offers its customers the capability to identify apps that host data outside of approved locations, enabling customers to set policies accordingly. For example, a customer can query for all apps that house data outside of one or a group of countries, and then enforce policies, such as “don’t allow the upload of personally identifiable information to apps outside of the EU.”

Customers can obtain more granular details by enforcing policies based on other contextual factors such as OU, user location, device type, activity, etc. For example, a policy could be set to “don’t allow anyone in Customer Support in the EU to share content from any CRM with anyone outside of the EU.”