--- title: Security guide source: https://docs.newrelic.com/docs/licenses/license-information/referenced-policies/security-guide --- **Last updated June 15, 2023.** This is supplement to our [security policy](https://docs.newrelic.com/docs/licenses/license-information/referenced-policies/security-policy) and serves as a guide to New Relic’s description of its Services, functionalities, and features. > #### πŸ’‘ TIP > > We may update the URLs in this document without notice. ## Security Program New Relic follows "privacy by design" principles as described here: . ## Security Domains New Relic’s policies and procedures cover industry-recognized security domains such as Endpoint Protection; Portable Media Security; Mobile Device Security; Wireless Security; Configuration Management; Vulnerability Management; Network Protection; Transmission Protection; Password Management; Access Control, Audit Logging & Monitoring; Education, Training, and Awareness; Third Party Assurance; Incident Management; Business Continuity and Disaster Recovery; Risk Management; Data Protection & Privacy; and Service Management Systems. ## Security Certifications New Relic audits its Services against industry standards as described at . ## Data Control, Facilities, and Encryption New Relic provides its customers controls of their data as follows: - New Relic's customers can use any number of methods to send data to New Relic's APIs, such as (1) using New Relic's software, (2) using vendor-neutral software that is managed and maintained by a third-party (e.g., [OpenTelemetry instrumentation](https://docs.newrelic.com/docs/integrations/open-source-telemetry-integrations/opentelemetry/introduction-opentelemetry-new-relic/#benefits) provided by [opentelemetry.io](opentelemetry.io), or (3) from third-party systems that customers manage and/or control. - New Relic's customers can use New Relic's Services such as NerdGraph to filter out and drop data. See [Drop data using nerdgraph](https://docs.newrelic.com/docs/telemetry-data-platform/manage-data/drop-data-using-nerdgraph/). - New Relic's customers can adjust their data retention periods as appropriate for their needs. See [Adjust retention](https://docs.newrelic.com/docs/telemetry-data-platform/manage-data/manage-data-retention/#adjust-retention). - New Relic's log management capabilities obfuscate numbers that match known patterns, such as bank card and social security numbers as described in our [log management security documentation](https://docs.newrelic.com/docs/logs/log-management/get-started/new-relics-log-management-security-privacy/). Customers that meet certain requirements can obfuscate their data as described [here](https://docs.newrelic.com/docs/logs/ui-data/obfuscation-ui/). - New Relic honors requests to delete personal data in accordance with applicable privacy laws. Please see . - Customers may use New Relic's APIs to query data, such as NerdGraph described [here](https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-nrql-tutorial/), and New Relic Services to export the data to other cloud providers. Customers that meet certain requirements can export their data as described [here](https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-streaming-export/) and [here](https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-historical-data-export/). - Customers can configure their log forwarder; see [this](https://docs.newrelic.com/docs/logs/enable-log-management-new-relic/enable-log-monitoring-new-relic/forward-your-logs-using-infrastructure-agent/) before sending infrastructure logs to New Relic. - For New Relic Customers in New Relic's AWS US, FedRAMP and HIPAA-enabled environments, Customer Data is replicated via Amazon Simple Storage Service (S3). For Customers in New Relic's Azure US environment, Customer Data is replicated via Azure storage to the off-site backup system via Amazon Simple Storage Service (S3). | | **Category of Customer** | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | Description | | **FedRAMP** | **HIPAA-enabled** | **US Gen Pop** | **EU Gen Pop** | | ----------- | ----------------- | -------------- | -------------- | | | Data is stored in Amazon Web Services (β€œAWS”). | | βœ“ | βœ“ | βœ“ | Limited | | - | - | - | ------- | | | \*Data is stored in Azure. | | | | βœ“ | Limited | | - | - | - | ------- | | | Data is stored in IBM | | | | | βœ“ | | - | - | - | - | | | Data for New Relic incident intelligence is stored in Google Cloud | | | | βœ“ | βœ“ | | - | - | - | - | | | New Relic regularly tests, assess, and evaluates its measures to ensure the security of processing using industry-recognized standards and uses independent third-party auditors as provided below: | | | Annual SOC 2 Type 2 | | βœ“ | βœ“ | βœ“ | βœ“ | | - | - | - | - | | | Annual FedRAMP assessment by an independent third-party pursuant to NIST 800-53 rev 4 Moderate authorization. | | βœ“ | | | | | - | - | - | - | | | Annual HITRUST-validated assessment by an independent third-party \*Pursuing CY2021 Q4 | | | βœ“ | | | | - | - | - | - | | | ISO 27001 | | βœ“ | βœ“ | βœ“ | βœ“ | | - | - | - | - | | | TISAX | | | | βœ“ | βœ“ | | - | - | - | - | | - The Services that operate on Amazon Web Services (β€œAWS”) are protected by the security and environmental controls of AWS. Detailed information about AWS security is available at and . Data encryption at rest utilizes FIPS 140-2 compliant encryption methodology. For AWS SOC Reports, please see . - The Services that operate on Google Cloud Platform ("GCP") are protected by the security and environmental controls of GCP. Detailed information about GCP security is available at . For GCP reports, please see . - \*The Services in the following data centers are being migrated and will be deprecated by July 2024: - IBM - Deft - Zayo - QTS ## Law Enforcement Request Report New Relic has not to date received any request for customer data from a law enforcement or other government agency (including under any national security process), and has not made any corresponding disclosures.