19. HDX is built using CKAN, an open-source data management system. 


20. Data that is uploaded to HDX is stored by OCHA on servers provided by Amazon Web Services. Data is encrypted in transit and at rest. The servers are located in Virginia, the United States of America. 


21. All data uploaded to HDX in csv, xls or xlsx format is sent via Google’s DLP API for automated scanning for sensitive data using the DLP algorithm. Data is encrypted in transit and scanned through DLP’s content method. Data is not retained by Google in this process. 


22. OCHA will never alter the values within resources shared through HDX without prior permission from the contributing organization. OCHA may make minor edits to correct errors in dataset descriptions and metadata. The activity stream of the dataset will show a notification if OCHA makes such edits. 


23. Data shared privately through the HDX platform will never be shared further by OCHA without prior permission from the contributing organization. 


24. OCHA will notify the contributing organization if we become aware of unauthorized access to private data. After notification OCHA will manage the incident in line with internal data incident management procedure.


25. OCHA will place data ‘under review’ if it is found to violate these Terms and will contact the contributing organization to discuss next steps.


26. OCHA may archive data that is more than five years old and is not updated or downloaded regularly. Contributors are notified if any of their data is archived. OCHA can restore archived data in the dataset list at the request of the contributing organization. Archived data is retained on OCHA’s infrastructure indefinitely.


27. Deleted data cannot be retrieved by users or organizations. Metadata continues to exist in backups of the HDX database indefinitely. Deleted data is purged from backups after 60 days. Deleted data marked as sensitive is purged immediately upon deletion.