客户托管的数据库，有限阅读[关闭]

Question

Imagine the following scenario. You're running a social media platform built with PHP7/MySQL as a PaaS (Platform as a Service), with lots of companies using the same solution. A big company wants to have a white-label solution of this, and import all of their customers into this solution.

Now you have a big problem, because this company doesn't want anyone to have access to their data. On the other hand, you don't want to let the customer host everything themselves since that would give them your source code.

One solution? Continue delivering the platform as PaaP, but with the platform talking directly to a customer-hosted MySQL database. However, this still makes it possible for you as a platform owner to steal their data.

Is it any possibility for the customer to limit queries or build any safeguards so that they can host the database, but also prevent us from stealing their data?

Answer 1

Get a lawyer and make data disclosure/protection agreement.

It is possible to encrypt connection data between PaaS server and database. But not the processing part, where PaaS server still need raw data afterwards to make the processing. Unless your PaaS are only mean to process encrypted data.

If both party don't trust each other, there is tons of accusation can be made on data leakage, e.g. the "big customer" can still accuse there is possible of data logger module collecting the info.

On the other hand, service provider may choose to recompile and obfuscate their code, throw in nasty checksum to prevent installation to another system, make software difficult to update and patch.