Member Avatar for Clif40RD

I need help understanding a point mentioned in Facebook's platform terms. In order to be able to actually certify that I comply, I've been trying to get feedback regarding this but it's proven to be tough for some reason.

In Section 5b.Tech Providers

ii.2) You will ensure that Platform Data you maintain on behalf of one Client is maintained separately from that of other Clients;

What does the above mean precisely? We have all our clients' data in the same database, same tables, does this mean that we're incompliant because all their data is stored in the same database?

  • 3 Contributors
  • 3 Replies
  • 81 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by Clif40RD

Dani AI

Generated

Useful clarification and practical steps to prepare evidence for certification (builds on points from and ).

The clause is about separating data by Client (the business or account you serve), not merely by individual end users. Compliance is usually shown by architectural and operational controls that prevent any accidental or intentional cross-Client access or reuse of Platform Data.

Typical options to implement and prove separation: separate databases or schemas per client; single-database multi-tenant designs with strong enforcement (row-level policies, server-side authorization, per-tenant encryption keys); or full isolation at the account/infrastructure level. Administrative controls matter too: RBAC, audit logs, retention and deletion processes, and subprocessors/contracts that forbid cross-client use. A short example of a database-level enforcement pattern (PostgreSQL row-level security):

ALTER TABLE records ENABLE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation ON records
  USING (tenant_id = current_setting('app.current_tenant')::int);

Set app.current_tenant on each DB session after authenticating the client; the DB then blocks any cross-tenant reads/writes.

For certification, prepare: architecture and dataflow diagrams, DB configs (RLS/policies, schema layout), key management mapping, sample audit logs, deletion/portability procedures, and automated tests that demonstrate isolation. For implementation guidance see Facebook Platform Policy and the OWASP Multi-Tenancy Cheat Sheet: Facebook Platform Policy and .

Recommended Answers

All 3 Replies

Member Avatar for Dani

I believe that means that you just have to store the user’s data individually associated with the user. For example, if you have a table in the database, there’s a different record for each user, such that you can retrieve a single user record.

I believe the purpose of the paragraph is to ensure that you aren’t aggregating data across many users and storing that aggregated data for the purpose of analyzing big data, etc., but that instead each user has an individual record in your data store that is meant to only benefit how that individual user uses your app.

Member Avatar for jwenting

Only way to be certain is to talk to a lawyer, who can then ask them...

But apart from Dani's suggestion, which is a good one, it can also mean you're not allowed to share the data with others (as that'd be potentially illegal, especially in the EU, but also cost Facebook money as they themselves make a lot of money selling that very data).

Member Avatar for Clif40RD

Apologies for the late response everyone.

Thanks for taking time to respond to my question guys, to be honest I think (regardless of some good suggestions), yes the only way to be truly certain is to ask a lawyer.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.