Headspace's Privacy Operations Center and Vault
summary
Headspace builds a Privacy Operations Center to unify governance, product risk review, DSAR handling and training across security, legal and engineering for 70–100M users in 190 countries and cites a $5,350 average cost to process a DSAR. A patented Vault Architecture encrypts psychotherapy notes in the browser with clinician-held keys stored in password managers, uses key encryption keys for care‑team sharing, and pairs an offline Secure Enclave (Cathedral) with an online encrypted DB (Bazaar) to prevent insider peeking and mass exfiltration.
AI-written summary · about
chapters (18)
- 0:00Headspace privacy initiatives
- 3:15Why prioritize privacy operations
- 9:41Founding the Privacy Operations Center
- 13:17Custom data classification
- 15:45Shifting privacy left with PRR
- 21:47Transition to technical privacy innovations
- 22:53Introducing Vault Architecture
- 27:06Prerequisites for Vault Architecture
- 28:10Client-side encryption and key management
- 31:27Secure Enclave for disaster recovery
- 33:55Cathedral and Bazaar architecture
- 37:14Key takeaways and timeline
- 41:03Q&A: Clinician data control and HIPAA
- 43:43Q&A: Encryption key management
- 45:05Q&A: Vault Architecture standards
- 45:46Q&A: DSAR request processing costs
- 47:09Q&A: Data classification tools
- 50:05Closing remarks
related talks
40mLessons Learned While Building a Privacy Operations Center at...
14mSecurity lifecycle management in a multicloud world
26mHow password managers are built for Privacy and Security
40mDay 2 keynote
51mIntroduction to Vault
15mRemediate secret sprawl at scale
24mRoche: Securing & Connecting Healthcare Platforms
01h 28mData privacy vault 101