Data Collection, Security, and Revocation Process

What Data is Collected

 Why This Data is Collected

• CrowdStrike API Key: Used to authenticate all API requests made to the CrowdStrike Falcon platform on behalf of COMPASS — enabling access to endpoint telemetry, detection events, and configuration data for compliance assessment.

 How Data is Secured

• Encryption at Rest: All credentials are encrypted using AES-256 in isolated, tenant-specific databases.

• Encryption in Transit: All communications use HTTPS/TLS 1.2+.

• Access Control: Only automated systems (not staff) can use your credentials for authorized operations.

• Audit Logging: Every access, refresh, and revocation is logged for compliance.

• Multi-Tenant Isolation: Your data is never mixed with other organizations.

 How to Revoke Access

Option 1: From COMPASS

1. Go to Integrations → Configurations

2. Click CrowdStrike under the Original Equipment Manufacturers (OEMs) page.

3. Under Actions column, click Delete.

Option 2: From CrowdStrike Falcon Console

1. Go to the CrowdStrike Falcon Console (https://falcon.crowdstrike.com/)

2. Navigate to Support & Resources → API Clients and Keys.

3. Locate the API key used for COMPASS and click Delete.

 What Happens After Revocation?

• COMPASS deletes all stored credentials and stops all access.

• Scheduled operations are cancelled.

You can reconnect anytime.