Include note about data never leaving the browser session

qlik-oss / catwalk

UI to ease the data modelling experience using Qlik Associative Engine.

https://catwalk.core.qlik.com

MIT License

50 stars 12 forks source link

Include note about data never leaving the browser session #186

Closed peol closed 5 years ago

peol commented 5 years ago

Nothing other than the browser session/client and engine will ever access the data in an app. catwalk is completely client-side so perhaps we can explain that clearly without as many words as this issue :)

|-----------------|
| Browser running |
| catwalk    |----|------------|
|--------|---|----|            |
         |   |                 |
   |-----|---|-|           |---|----|
   |    you    |           | engine |
   |-----------|           |--------|

RobWunderlich commented 5 years ago

The note is useful, but I think you are also going to need to explain why catwalk.core.qlik.com needs to be whitelisted. Me to Admin at Bank: "I need you to whitelist this external domain on the Enterprise Server virtual proxy. But don't worry, it won't access any data"

mountaindude commented 5 years ago

I am coming from exactly the same spot as @RobWunderlich. Will be a very tough sell getting this approved in enterprises.

Suggestion from @peol to deploy it locally on an internal webserver is good, and should not involve too much work. Personally I'd like to see catwalk wrapped up as a Docker image to make internal deployment even easier.

skokenes commented 5 years ago

Should also be trivial to bundle it as a mashup that you can upload to a QMC as an extension

peol commented 5 years ago

There are multiple issues in this one, so we will track these separately:

This issue will be about introducing a "Data Policy" which will contain clarifications around what data is collected (e.g. Google Analytics/cookies), how websockets work (e.g. we're running in browser environment only), and the rationale about whitelisting the catwalk domain in QSE (e.g. see catwalk as an externally hosted mashup which you would need to whitelist).
In #198 we are tracking supplying a Docker image as an alternative to catwalk.core.qlik.com.
In #199 we are planning on changing the default app list in catwalk from the local engine (and fail), to a sensible default (core-hosted apps, no need for an engine). This helps with the data policy and gracefully introduce users.