Systems and methods for securely using cloud services on on-premises data
The present disclosure relates to systems and methods for providing cloud-based services securely to on-premises networks or other infrastructure. More particularly, the present disclosure relates to systems and methods for enriching first-party data (e.g., data collected directly by an on-premises server) stored within on-premises networks by enabling the on-premises networks to retrieve and process third-party data stored on cloud-based networks. As a technical benefit, cloud-based services can be performed on the first-party data within the on-premises networks.
1. A computer-implemented method comprising:
accessing a cloud-based data management system that stores third-party data, the third-party data characterizing an interaction between an anonymous user device and a web server, and the third-party data being stored in association with a third-party user identifier (ID) of a plurality of third-party user IDs;
receiving entity-controlled executable code that, when executed, configures a private pixel server and a first-party profile database within an on-premises network or other infrastructure exclusively controlled by an entity, and the private pixel server being configured to track interactions between a web server associated with the entity and user devices;
in response to receiving the entity-controlled executable code, configuring each of the private pixel server and the first-party profile database within the on-premises network or other infrastructure exclusively controlled by the entity, wherein the configuring generates a virtual private cloud that is accessible by the private pixel server or users of the on-premises network but not accessible by other users:
receiving an indication that a particular user device interacted with the web server associated with the entity, the indication being generated by the private pixel server;
generating first-party data based on the interaction between the particular user device and the web server associated with the entity, the first-party data characterizing the interaction between the particular user device and the web server associated with the entity;
storing the first-party data at the first-party profile database controlled by the entity, the first-party data being stored in association with a first-party user ID;
transmitting a communication corresponding to a request for third-party data associated with the first-party user ID;
in response to transmitting the communication, establishing a link between the first-party user ID associated with the first-party data and one or more third-party user IDs associated with a portion of the third-party data;
receiving the portion of the third-party data;
storing, at the first-party profile database, the portion of the third-party data in association with the first-party user ID, the portion of the third-party data enriching the first-party data associated with the first-party user ID; and
performing one or more analytic processes on the enriched first-party data, the one or more analytic processes being performed within the on-premises network.
2. The computer-implemented method of claim 1 , further comprising:
providing an interface enabling a user associated with the entity to update the third-party data stored at the cloud-based data management system with the first-party data associated with the first-party user ID;
using the interface to transmit the first-party data to the cloud-based data management system, the first-party data being transmitted using an application programming interface (API) configured to communicate with the cloud-based data management system; and
updating or deleting the third-party data with the first-party data, the updating being based at least in part on the established link between the first-party user ID and the one or more third-party user IDs.
3. The computer-implemented method of claim 2 , wherein the particular user device has provided consent for the first-party data to be transmitted to the cloud-based data management system.
4. The computer-implemented method of claim 1 , wherein the on-premises network is not controlled by the cloud-based data management system.
5. The computer-implemented method of claim 2 , further comprising:
monitoring communications that use the API, the communications being exchanged between the on-premises network and the cloud-based data management system, the monitoring comprising identifying one or more instances in which third-party data was retrieved from the cloud-based data management system and stored at the first-party profile database; and
charging the entity for each instance of the one or more instances.
6. The computer-implemented method of claim 5 , wherein the interface further enables the user associated with the entity to manage entity consent to a charge.
7. The computer-implemented method of claim 2 , wherein the interface further enables the user associated with the entity to perform the one or more analytic processes, wherein performing the one or more analytic processes comprises:
retrieving the portion of the third-party data on-demand from the cloud-based data management system; and
establishing the link between the first-party user ID and the one or more third-party user IDs, thereby linking the first-party data to the portion of the third-party data, wherein the link is revocable.
8. A system, comprising:
one or more processors; and
a non-transitory computer-readable storage medium containing instructions which, when executed on the one or more processors, cause the one or more processors to perform operations including:
accessing a cloud-based data management system that stores third-party data, the third-party data characterizing an interaction between an anonymous user device and a web server, and the third-party data being stored in association with a third-party user identifier (ID) of a plurality of third-party user IDs;
receiving entity-controlled executable code that, when executed, configures a private pixel server and a first-party profile database within an on-premises network or other infrastructure exclusively controlled by an entity, and the private pixel server being configured to track interactions between a web server associated with the entity and user devices;
in response to receiving the entity-controlled executable code, configuring each of the private pixel server and the first-party profile database within the on-premises network or other infrastructure exclusively controlled by the entity, wherein the configuring generates a virtual private cloud that is accessible by the private pixel server or users of the on-premises network but not accessible by other users;
receiving an indication that a particular user device interacted with the web server associated with the entity, the indication being generated by the private pixel server;
generating first-party data based on the interaction between the particular user device and the web server associated with the entity, the first-party data characterizing the interaction between the particular user device and the web server associated with the entity;
storing the first-party data at the first-party profile database controlled by the entity, the first-party data being stored in association with a first-party user ID;
transmitting a communication corresponding to a request for third-party data associated with the first-party user ID;
in response to transmitting the communication, establishing a link between the first-party user ID associated with the first-party data and one or more third-party user IDs associated with at least a portion of the third-party data;
receiving the portion of the third-party data;
storing, at the first-party profile database, the portion of the third-party data in association with the first-party user ID, the portion of the third-party data enriching the first-party data associated with the first-party user ID; and
performing one or more analytic processes on the enriched first-party data, the one or more analytic processes being performed within the on-premises network.
9. The system of claim 8 , wherein the operations further comprise:
providing an interface enabling a user associated with the entity to update the third-party data stored at the cloud-based data management system with the first-party data associated with the first-party user ID;
using the interface to transmit the first-party data to the cloud-based data management system, the first-party data being transmitted using an application programming interface (API) configured to communicate with the cloud-based data management system; and
updating or deleting the third-party data with the first-party data, the updating being based at least in part on the established link between the first-party user ID and the one or more third-party user IDs.
10. The system of claim 9 , wherein the particular user device has provided consent for the first-party data to be transmitted to the cloud-based data management system.
11. The system of claim 8 , wherein the on-premises network is not controlled by the cloud-based data management system.
12. The system of claim 9 , wherein the operations further comprise:
monitoring communications that use the API, the communications being exchanged between the on-premises network and the cloud-based data management system, the monitoring comprising identifying one or more instances in which third-party data was retrieved from the cloud-based data management system and stored at the first-party profile database; and
charging the entity for each instance of the one or more instances.
13. The system of claim 12 , wherein the interface further enables the user associated with the entity to manage entity consent to a charge.
14. The system of claim 9 , wherein the interface further enables the user associated with the entity to perform the one or more analytic processes, wherein performing the one or more analytic processes comprises:
retrieving the portion of the third-party data on-demand from the cloud-based data management system; and
establishing the link between the first-party user ID and the one or more third-party user IDs, thereby linking the first-party data to the portion of the third-party data, wherein the link is revocable.
15. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a processing apparatus to perform operations including:
accessing a cloud-based data management system that stores third-party data, the third-party data characterizing an interaction between an anonymous user device and a web server, and the third-party data being stored in association with a third-party user identifier (ID) of a plurality of third-party user IDs;
receiving entity-controlled executable code that, when executed, configures a private pixel server and a first-party profile database within an on-premises network or other infrastructure exclusively controlled by an entity, and the private pixel server being configured to track interactions between a web server associated with the entity and user devices;
in response to receiving the entity-controlled executable code, configuring each of the private pixel server and the first-party profile database within the on-premises network or other infrastructure exclusively controlled by the entity, wherein the configuring generates a virtual private cloud that is accessible by the private pixel server or users of the on-premises network but not accessible by other users;
receiving an indication that a particular user device interacted with the web server associated with the entity, the indication being generated by the private pixel server;
generating first-party data based on the interaction between the particular user device and the web server associated with the entity, the first-party data characterizing the interaction between the particular user device and the web server associated with the entity;
storing the first-party data at the first-party profile database controlled by the entity, the first-party data being stored in association with a first-party user ID;
transmitting a communication corresponding to a request for third-party data associated with the first-party user ID;
in response to transmitting the communication, establishing a link between the first-party user ID associated with the first-party data and one or more third-party user IDs associated with at least a portion of the third-party data;
receiving the portion of the third-party data;
storing, at the first-party profile database, the portion of the third-party data in association with the first-party user ID, the portion of the third-party data enriching the first-party data associated with the first-party user ID; and
performing one or more analytic processes on the enriched first-party data, the one or more analytic processes being performed within the on-premises network.
16. The computer-program product of claim 15 , wherein the operations further comprise:
providing an interface enabling a user associated with the entity to update the third-party data stored at the cloud-based data management system with the first-party data associated with the first-party user ID;
using the interface to transmit the first-party data to the cloud-based data management system, the first-party data being transmitted using an application programming interface (API) configured to communicate with the cloud-based data management system; and
updating or deleting the third-party data with the first-party data, the updating being based at least in part on the established link between the first-party user ID and the one or more third-party user IDs.
17. The computer-program product of claim 16 , wherein the particular user device has provided consent for the first-party data to be transmitted to the cloud-based data management system.
18. The computer-program product of claim 15 , wherein the on-premises network is not controlled by the cloud-based data management system.
19. The computer-program product of claim 16 , wherein the operations further comprise:
monitoring communications that use the API, the communications being exchanged between the on-premises network and the cloud-based data management system, the monitoring comprising identifying one or more instances in which third-party data was retrieved from the cloud-based data management system and stored at the first-party profile database; and
charging the entity for each instance of the one or more instances.
20. The computer-program product of claim 19 , wherein the interface further enables the user associated with the entity to manage entity consent to a charge.