Privacy

Fivetran uses the AICPA/CICA Privacy Maturity Model “Privacy Maturity Model” to measure the success of our privacy program. Our philosophy is based on popular privacy concepts such as Privacy by Design and Privacy by Default, but we believe having an excellent privacy program goes beyond those concepts and requires dedicated personnel, policy enforcement, and continuous monitoring. We believe privacy is about using personal data responsibly and in line with customer and data subjects’ expectations.

Learn more in our Privacy Notice.

Retention of customer data

How long we retain customer data depends on the data type:

In the following two cases, customer data is purged as soon as it is successfully written to the destination. If the data writing process takes longer than usual, the data is automatically purged after 30 days using object lifecycle management:

• Destination outage: If your destination is down, we maintain the data that we've read from your source so that we can resume the sync without losing progress once the issue is resolved.
• Schema information for data blocking or column hashing purposes: If you choose to block or hash columns before running the initial sync for your new connector, we query your data source and cache your data while we fetch the full schema. We write to the destination only the data you selected as tables and columns from the fully fetched schema and only when you approved the selection.

Fivetran data residency

Fivetran runs data connectors on servers in the United States (US), Canada, European Union (EU), United Kingdom (UK), Australia, Singapore, India, Japan, Indonesia, and the Middle East. You can select your preferred data processing location when configuring your destination. All connectors configured in a destination run in the destination's designated location. This means that in most cases, your data will not leave our region-specific servers during processing. For example, if you configure your destination to use our EU servers, your data will not leave the EU during processing. See our destination documentation to learn how to configure your data processing location.

Certain connectors, such as the email connector and connectors that sync webhooks and event data, as well as customer support requests, unless you have purchased Fivetran’s U.S. only support option. By default, we store email connector and event data in a cloud storage service in one of the following data processing locations:

• the EU location - for destinations run in the EU location
• the UK location - for destinations run in the UK location
• the US location - for all other destinations

Fivetran runs our services on Google Cloud Platform (GCP), Amazon Web Services (AWS), and Azure. The following table lists regions supported by Fivetran for each service provider:

*NOTE: Default region for a given cloud provider / geography combination.

IMPORTANT: Google Cloud Platform is the default cloud service provider. Google Cloud Platform is your only cloud service provider if you're on a Starter, Standard, or Free plan. You can select a different cloud service provider if you are on an Enterprise or Business Critical plan.

Regardless of the plan you use, you can select the geography when creating a destination. If you are on an Enterprise or Business Critical plan, you also can select the cloud service provider. Lastly, if you are on a Business Critical plan, you can select a cloud region.

NOTE: For some cloud providers and geographies, there is only one region available.

IMPORTANT: You need to safelist the corresponding Fivetran IPs in your firewall for the geography and region you selected for your destination.

Data protection assessments (PTAs and PIAs)

We have a process for Privacy Threshold Assessments (PTAs) and for Privacy Impact Assessments (PIAs). The templates are based on ISO privacy standards (29134 and 27701) and are intended to cover a multitude of international regimes that we comply with. We conduct quarterly data protection assessments based on the Privacy Maturity Model, which is intended to cover more than the Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data - General Data Protection Regulation (GDPR). It’s designed to cover more than the applicable data protection laws in order to truly measure the maturity of our privacy program.

Privacy by Design and Default

In addition to our data protection assessment process, we have a privacy engineering guidance playbook to assist our engineers in how to build with privacy in mind in order to comply with Privacy by Design and Privacy by Default principles.

Dedicated personnel

We have a Data Protection Officer and dedicated privacy personnel who are accountable and responsible for our compliance with applicable data protection laws.

Handling of legal access requests

We have a policy to handle these types of requests and will notify customers to the extent permitted under applicable law.

DSARs and privacy complaints handling process

We have a process for handling both DSARS and privacy complaints via our privacy@fivetran.com email distribution and have internal training on how to handle those requests as well as specialized privacy personnel who assist in handling requests.

Data mapping, including a record of data processing activities (ROPA)

We have a personal data inventory for our systems (which does not scan customer pipeline data). The inventory includes details of data types being processed, such as the data field and whether or not it is sensitive personal data, descriptions of the processing being performed, and transfers of personal data. We use a third party vendor tool to ensure we have a ROPA that complies with GDPR and other strict international privacy law. In addition, our tool provides insights to ensure we have the correct contractual language in place with our third party vendors.

Data protection legal analysis and keeping up with changing regulations

We conduct our data protection legal analysis across over one hundred laws and frameworks, monitor changes in applicable law, and analyze our reconciled approach across these laws and frameworks. When we receive an alert for a change in applicable privacy law, we update our legal requirements summaries, our data protection gap analysis matrix across all regimes and our privacy program roadmap as appropriate.

Compliance with applicable registrations

We have the necessary data protection registrations under applicable law and can provide registration information in due diligence upon request.

Health Insurance Portability and Accountability Act (HIPAA)

Under The HIPAA Security Rule, Fivetran does comply with HIPAA requirements for Protected Health Information (PHI) and will sign a Business Associate Agreement (BAA) with customers who are subject to HIPAA mandates (typically, HIPAA covered entities). Fivetran is not a covered entity under HIPAA rules, and therefore cannot be "HIPAA compliant", since HIPAA itself applies to covered entities (that is, those entities that are subject to regulation by the HHS). Fivetran serves as a data pipeline, which means that PHI traversing the Fivetran environment is not permanently stored. All transmissions are encrypted using industry best practices (at present, TLS 1.2+). Temporary storage may occur when the amount of data transmitted exceeds the capacity for real-time processing, and as a result, requires short-term caching. Such temporary storage is encrypted. All customer data, including PHI, is purged from Fivetran's system as soon as it is successfully written to the destination.

Sub-processor management

Fivetran uses certain subprocessors to assist us in providing the Fivetran Services as described in the Terms of Service (TOS). We maintain a list of sub-processors and provide notice for any additions.

NOTE: Defined terms used herein shall have the same meaning as defined in the TOS.

What is a Subprocessor?

A subprocessor is a third-party data processor engaged by Fivetran, including entities from within the Fivetran Group, who has or potentially will have access to or process personal data on behalf of a Customer. Fivetran engages different types of subprocessors to perform various functions as explained in the tables below. Fivetran refers to third parties that do not have access to or process personal data on behalf of a Customer, but who are otherwise used to provide the Services, as "subcontractors" and not "subprocessors". The list includes the ability for our customers to request a preferred email contact to receive notifications of changes. Customers may send their preferred email contact to privacy@fivetran.com.

Pipeline Data Subprocessors

These are subprocessors who have access to Fivetran production systems and data by virtue of the services they provide.

Affiliates

Fivetran Inc. maintains affiliate companies in countries where our full-time employees work. Each of these affiliate companies comprises members of the Fivetran team who contribute from outside the United States.

Access

IMPORTANT: Neither Fivetran nor our subprocessors are able to access your customer data without your explicit approval.

HCL Technologies Limited and Grid Dynamics Holdings, Inc. (DAXX) are both utilized to support Fivetran's HVR and HVA products. They do not have access to customer data by default and would only have access with the explicit authorization of the customer through a Support case using our standard Diagnostic Data Access process.

Fivetran uses Alto Logica to outsource hiring for engineering talent, but Fivetran does not outsource the development; these engineers follow all of Fivetran's controls. They use the same authentication and access control systems as our internal full-time employees (Okta MFA) and follow the same procedures as outlined below.

By default Fivetran personnel do not have access to customer data. In the event a customer has a connector failure and contacts Fivetran Support, Fivetran may need to debug the failure against customer data if other troubleshooting fails. In such an event Fivetran Support would request Diagnostic Data Access where the customer’s admin would need to approve Fivetran access in the Fivetran dashboard. Once access has been approved, the request may be routed to one of Fivetran’s engineering teams that develop the Fivetran connectors to investigate the failure. Fivetran maintains a global development organization with teams located in the United States, Ireland, India, the Netherlands, and Serbia. Which team the issue is routed to will depend on the connector that has the customer issue to resolve the failure as quickly as possible. This debugging environment is tightly controlled and activity is monitored by Fivetran’s Security team. Access is automatically revoked after 21 days or when the customer disables Diagnostic Data Access in their dashboard.

Additionally, for customers that cannot have data access from countries outside of the United States, Fivetran offers U.S. only support for an additional cost.

Fivetran uses a single sign-on (SSO) service to manage access control and permission provisioning, based on user role within the organization. Role-based access is established through Fivetran’s single sign-on providers which is integrated with Fivetran’s Human Resources system. Employee role assignments are automatically updated when employment is terminated or departments/roles change. In addition, Fivetran performs quarterly user access reviews of access to customer facing systems.

History - Archived versions

Cross-border transfers

We are certified under the EU-US Data Privacy Framework, the UK extension to the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. We can also agree to use Standard Contractual Clauses (SCCs) to comply with cross-border transfers and can provide a Transfer Impact Assessment (TIA) upon request.

Privacy contractual language

Our privacy contractual language is intended to comply with GDPR and data protection regimes across the globe. We have templates for customer DPAs, vendor DPAs, and BAAs.

Required privacy training

We require all employees to take privacy training at least annually.

Cookie consent management and audits

We use OneTrust to manage cookie consent to comply with GDPR and applicable data protection regimes across the globe. We conduct quarterly audits to ensure our legal rules are up to date, the system is working properly, and we are covering all applicable domains.

Questions

Ensuring our platform is built with privacy is vital to earning and maintaining our customers’ trust. As a leader in automated data integration, we strive to keep Fivetran easy to use while keeping privacy top of mind. To learn more about Fivetran, contact our sales team at sales@fivetran.com. To report a privacy concern, email us at privacy@fivetran.com or DPO@fivetran.com.