Manage access to sensitive data with Data Access Control

Enterprise-level organizations often collect data that can include revenue data, personally identifiable information (PII), and other sensitive information. Amplitude’s data access control (DAC) feature enables these organizations to easily manage access to these categories of data, in a way that prevents unauthorized users from gaining access to it, and that helps prevent the data from inadvertently leaking out.

DAC works within Amplitude’s Groups framework. Admins grant or restrict access to PII, revenue data, and sensitive information to all members of a group. From there, they can add or remove users from these groups as access requirements change, either on an individual or organizational level.

For example, when an unauthorized user tries to view a chart that includes restricted information, Amplitude blocks the chart from loading on the user’s screen. Those users are also unable to create new charts that might include restricted data. This is true not only for charts, but also for cohorts, dashboards, notebooks, and user sessions.

When a user encounters a chart they’re unable to view because of the presence of restricted data, Amplitude specifies the properties or cohorts DAC has blocked.

The user can then exclude the restricted data and view the chart (or cohort, dashboard, notebook, or user session) without it.

Set access for specific categories of sensitive data

Setting access levels is a two-stage process. First, classify your data. When that’s complete, you can set up permissions.

Classify properties

1. In Amplitude Data, navigate to Properties and select the tab that contains the properties you want to classify.
2. Click the name of the property you’re interested in. You can manage event, user, and group properties directly; derived properties inherit all the classifications of their parent properties.
3. In the details panel that opens, click the Classification drop-down and select all relevant classifications for this property. Then click Send.
4. Repeat steps 2 and 3 for each property you want to classify.

Set up permissions

1. Navigate to Settings > Organization settings > Groups and click the name of the group you’re interested in. You can also create a new group.
2. Open the group’s Data Access tab. All three controllable classifications are visible here: PII, revenue, and sensitive.
3. For each classification, select Yes to allow members of the group to view this data, or No to deny them access.
4. When you’re done, click Save.