How does ESRI deal with confidentiality?

Question

An online connection is required to work in ArcGIS Pro so I'd like to know who is monitoring our online session.  I am contemplating a full license for ArcGIS Pro for my business but I have many clients who are very nervous about having any of their mapping information online because their maritime boundaries are often sensitive and a matter of national sovereignty. Some of those clients are embroiled in ICJ court cases with other countries and are worried about spying or hacking.  They don't even allow me to take any data on my computer out of the country.  How can we be reassured ESRI is not collecting any of our data? Do they have any legal statements about this that I can find in the documentation? Confidentiality NationalSecurity ##ICJ

ThomasColson · Answer

Actually here is your don't-need-a-lawyer answer: As you mention maritime boundaries, which is very clearly a national security issue, it wouldn't even take a court order for ESRI to release it:

Products & Services Privacy Statement Supplement | Esri

Esri will not disclose Customer Data, Administrator Data, Payment Data or Support Data outside of Esri or its controlled subsidiaries and affiliates except (1) as you direct, (2) with permission from an end user, (3) as described in this Products & Services Privacy Statement Supplement or in your agreement(s) with Esri, or (4) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may share Administrator Data with third parties for purposes of fraud prevention.

In your case, I'd stand up an internal Portal for ArcGIS, which gives you the same functionality as AGOL, but you have 100% over the security and release of any data stored within. By internal, I mean on-prem: A portal you host in Amazon could be subject to the same host-state laws.

ThomasColson · Answer

The laws of the State of California, in which ESRI is headquartered, allow for a court to compel ESRI to provide any data it holds as a discovery request response, or FOIA request. Is this likely to happen? Very likely not.......  As such, if an organization has data that cannot be subject to uncontrolled release under those or similar situations, you should not store it in AGOL. Ultimately, your org should have a legal review of your SLA/EULA with ESRI, and develop a policy regarding sensitive data, as neither Geonet or other users will provide an answer that will survive a court challenge.

GISMallku · Answer

Great responses from all above, but I thought we could also add a bit more info.

1. As Robert LeClair‌ pointed out, with a purchased license of ArcGIS Desktop, you will be able to convert the ArcGIS Pro Named User license to Single Use or Concurrent Use.  You do not have that same flexibility with the Personal Use license.  Also, I think it is super important to be clear on this statement:

"An online connection is required to work in ArcGIS Pro"

That is not true. An online connection is not required to work in ArcGIS Pro.

2. As for any information that is collected, you should read The Esri User Experience Improvement program section of  Report software errors—ArcGIS Pro | ArcGIS Desktop which also points to FAQ: How does the Esri User Experience Improvement program work for ArcGIS Desktop?

Due to your concern, I'd recommend turning that off, even though the data that the EUEI collects is unrelated to your concerns:

Hope this helps!