Overview

Advanced Compliance helps companies in healthcare or other highly regulated industries benefit from Branch's comprehensive set of mobile measurement tools, without sacrificing user privacy.

With Advanced Compliance, your data is sent to an isolated network endpoint, which hashes PII as soon as it's received. Branch encrypts the original values and decrypts them only to send data to the integrations and webhooks you enable.

Privacy in the mobile marketing ecosystem is ever changing, and Branch strives to support all of your mobile linking and measurement needs as the landscape continues to evolve.

Advanced Compliance features

The Advanced Compliance add-on gives you access to:

• Advanced Privacy-Preserving Attribution: Supports safe and proper attribution when handling data related to protected health information (PHI).
• Advanced Security Gateway: A separate data architecture, including an isolated network with custom traffic routing, strong authentication, and multiple levels of encryption.
• Protected API Endpoint: Your data flows through a protected and isolated environment, in which sensitive data is locked and subsequently available only where necessary for specific business needs.

Compatibility

Advanced Compliance is capable of supporting both Engagement and Performance customers. It may be included as an add-on to either product.

Advanced Compliance is also compatible with Advanced Data Feeds, which is an add-on as well. However, Advanced Compliance hashes certain fields, which limits how you can use data feeds and other integrations. See Limitations for details.

Engagement

Engagement is fully compatible with Advanced Compliance. This includes features like:

• Linking
• Journeys
• Email Integrations
• QR Codes
• Organic Attribution

Performance

Performance features that are compatible with Advanced Compliance include:

• Ad Partner Integrations
• Paid Attribution
• Fraud Defense (with limitations)
• ROI Hub
• Household Measurement

Engagement Builder isn't compatible. See Limitations.

Third Party Integrations: Customers should consult with their Legal team and review third party terms before enabling integrations for Advanced Compliance. Some integrations require certain data fields (e.g., IP address, IDFA) to function. You are responsible for your data once you enable an integration and direct Branch to send your data (which may include data regulated by HIPAA), outside of Branch services to a third party.

Advanced Data Feeds

The Advanced Data Feeds add-on works alongside Advanced Compliance to bring you powerful reporting capabilities using:

• Data Integrations (this does not include server-to-server integrations for inbound data)
• Data Exports
• Custom Webhooks

Limitations

Because Advanced Compliance hashes PII when Branch receives it, these limitations apply:

• Data exports: Exports contain hashed values for the fields that Advanced Compliance hashes, including exports from the Exports API and custom exports. For example, an export contains hashes in the IP address and advertising ID fields. See Hashed fields for the full list.
• Custom webhooks and data integrations: Branch decrypts and sends the original values, not hashes, to the webhooks and data integrations you enable. You’re responsible for your data once you direct Branch to send it to a third party. Review Third Party Integrations before you enable one.
• Fraud rules: Fraud rules that rely on PII, such as a rule based on IP address, don't work reliably because Advanced Compliance hashes the IP address.
• Engagement Builder: Engagement Builder, a feature in the Performance product, isn't compatible with Advanced Compliance.

Hashed fields

Advanced Compliance applies a salted SHA-256 hash to fields as soon as Branch receives a request. The fields depend on the request type:

Request type	Hashed fields
Install and open (SDK session start)	IP addresses: ip, local_ip Mobile device IDs: advertising_ids, anon_id, google_advertising_id, hardware_id, imei, ios_vendor_id, mac_address Connected TV IDs: lg_ifa, panasonic_ifa, playstation_ifa, roku_rida, samsung_ifa, xbox_msai Click and referrer IDs: gbraid, google_search_install_referrer, referrer_gclid, sccid Other: identity
Event (custom, commerce, content, and lifecycle events)	IP addresses: user_data.ip, user_data.local_ip Mobile device IDs: user_data.advertising_ids, user_data.aaid, user_data.anon_id, user_data.android_id, user_data.idfa, user_data.idfv, user_data.imei, user_data.mac_address Click IDs: gbraid, referrer_gclid, sccid User identity: user_data.developer_identity Content items: $address_street, $address_city, $address_region, $address_postal_code
Click	IP addresses: device_ip, ip, ip_address, local_ip Mobile device IDs: aaid, anon_id, android_id, gaid, google_advertising_id, hardware_id, idfa, idfv, imei, ios_vendor_id, kindle_id, mac_address, oaid, windows_advertising_id Connected TV IDs: lg_ifa, panasonic_ifa, playstation_ifa, roku_rida, samsung_ifa, xbox_msai Click and referrer IDs: gbraid, google_search_install_referrer, referrer_gclid, sccid Other: identity, and the $-prefixed identifiers
Impression	IP addresses: device_ip, ip, ip_address, local_ip Other: the $-prefixed identifiers
Request headers	The client IP address that Branch derives from the request, and the X-Real-IP header

Prefixed identifiers

Click and impression requests also hash these $-prefixed identifiers:

• $aaid, $idfa, $idfv, $imei, $oaid, $uifa, and $mac_address
• $lg_ifa, $panasonic_ifa, $playstation_ifa, $roku_rida, $samsung_ifa, and $xbox_msai
• The _md5 and _sha1 versions of $aaid, $idfa, $imei, and $oaid

Exceptions

Branch doesn't hash these fields or requests:

• Cleared: Branch clears these values instead of hashing them, so they're empty in your data:
  • Request fields: install_referrer_extras on open and click requests, and $latitude and $longitude on event content items
  • Derived location data: location data that Branch derives from the IP address, such as city, postal code, latitude, and longitude
• Not hashed: Branch doesn't hash identity_id, link_identifier, device_fingerprint_id, randomized_device_token, browser_fingerprint_id, or randomized_bundle_token, because these are Branch-generated identifiers.
• Not applicable: Link creation (including bulk link creation), QR code, pageview, and dismiss requests don't contain hashed fields in the request body. Branch still hashes the client IP address in their request headers.

Enable Advanced Compliance

Once you have added Advanced Compliance as an add-on to your Branch Account, you can use the steps below to enable it.

1. Configure Branch SDK

Configure your Branch SDK to use this API endpoint: https://protected-api.branch.io

SDK version requirements

Platform	Minimum Version	Full Reference
Android	v5.9.0	Use the setAPIUrl() method.
iOS	v3.2.0	Use the setAPIUrl() method.
Web	v.2.82.0	Use the setAPIUrl() method. Make sure to call it before init().
React Native	v6.2.0	Use your branch.json file to set the API endpoint.

Example implementations

Java

//Inside LauncherActivity

@Override
protected void onStart() {
	super.onStart();

Branch.setAPIUrl("https://protected-api.branch.io");

	Branch.sessionBuilder(this).withCallback(new Branch.BranchUniversalReferralInitListener() {
		@Override
		public void onInitFinished(BranchUniversalObject branchUniversalObject, LinkProperties linkProperties, BranchError error) {
			if (error != null) {
				Log.e("BranchSDK_Tester", "branch init failed. Caused by -" + error.getMessage());
			} else {
				Log.i("BranchSDK_Tester", "branch init complete!");
				if (branchUniversalObject != null) {
					Log.i("BranchSDK_Tester", "title " + branchUniversalObject.getTitle());
					Log.i("BranchSDK_Tester", "CanonicalIdentifier " + branchUniversalObject.getCanonicalIdentifier());
					Log.i("BranchSDK_Tester", "metadata " + branchUniversalObject.getContentMetadata().convertToJson());
				}

				if (linkProperties != null) {
					Log.i("BranchSDK_Tester", "Channel " + linkProperties.getChannel());
					Log.i("BranchSDK_Tester", "control params " + linkProperties.getControlParams());
				}
			}
		}
	}).withData(this.getIntent().getData()).init();
}

Kotlin

//Inside LauncherActivity

// Always initialize Branch in `onStart()` - see warnings below for details
override fun onStart() {
	super.onStart()
  
  Branch.setAPIUrl("https://protected-api.branch.io")
  
	Branch.sessionBuilder(this).withCallback { branchUniversalObject, linkProperties, error ->
		if (error != null) {
			Log.e("BranchSDK_Tester", "branch init failed. Caused by -" + error.message)
		} else {
			Log.i("BranchSDK_Tester", "branch init complete!")
			if (branchUniversalObject != null) {
				Log.i("BranchSDK_Tester", "title " + branchUniversalObject.title)
				Log.i("BranchSDK_Tester", "CanonicalIdentifier " + branchUniversalObject.canonicalIdentifier)
				Log.i("BranchSDK_Tester", "metadata " + branchUniversalObject.contentMetadata.convertToJson())
			}
			if (linkProperties != null) {
				Log.i("BranchSDK_Tester", "Channel " + linkProperties.channel)
				Log.i("BranchSDK_Tester", "control params " + linkProperties.controlParams)
			}
		}
	}.withData(this.intent.data).init()
}

Swift

//insides AppDelegate  

func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
	// Override point for customization after application launch
    Branch.setAPIURL("https://protected-api.branch.io")

	// This version of `initSession` includes the source UIScene in the callback
	BranchScene.shared().initSession(launchOptions: launchOptions, registerDeepLinkHandler: { (params, error, scene) in
		
	})
	return true
}

Objective-C

//inside AppDelegate

- (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions {
    // Override point for customization after application launch.
   [Branch setAPIURL:@"https://protected-api.branch.io"];
  
    [[BranchScene shared] initSessionWithLaunchOptions:launchOptions registerDeepLinkHandler:^(NSDictionary * _Nullable params, NSError * _Nullable error, UIScene * _Nullable scene) {
        
    }];

    return YES;
}

Web - HTML

<!doctype html>
<html>
  <head>
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>My Page</title>
    <script>
      // load Branch
      (function(b, r, a, n, c, h, _, s, d, k) {
        if (!b[n] || !b[n]._q) {
          for (; s < _.length;) c(h, _[s++]);
          d = r.createElement(a);
          d.async = 1;
          d.src = "https://cdn.branch.io/branch-latest.min.js";
          k = r.getElementsByTagName(a)[0];
          k.parentNode.insertBefore(d, k);
          b[n] = h
        }
      })(window, document, "script", "branch", function(b, r) {
        b[r] = function() {
          b._q.push([r, arguments])
        }
      }, {
        _q: [],
        _v: 1
      }, "addListener banner closeBanner closeJourney data deepview deepviewCta first init link logout removeListener setBranchViewData setIdentity track trackCommerceEvent logEvent disableTracking getBrowserFingerprintId crossPlatformIds lastAttributedTouchData setAPIResponseCallback qrCode setRequestMetaData setAPIUrl getAPIUrl setDMAParamsForEEA".split(" "), 0);
      // Set API URL after loading Branch
      branch.setAPIUrl('https://protected-api.branch.io');
      // init Branch
      branch.init('key_live_YOUR_KEY_GOES_HERE');
    </script>
  </head>
  <body></body>
</html>

2. Configure your link domain

At this time, only app.link subdomains and custom root domains are supported.

Subdomains

If you are only using the default app.link subdomain, no additional actions in this step are required.

Configure specific subdomains on app.link before enabling Advanced Compliance.

Custom domains

Configure custom domains in Branch using our guide, then get in touch with Branch for next steps.

Custom subdomains are not supported.

3. Complete domain salt configuration

For attribution to function correctly, Branch must configure the domain salt that Advanced Compliance uses to hash your data for your app and links. To initiate it, file a high-priority support ticket with Branch.

Warning

This step is required. If your app is released with the updated API endpoint before the domain salt is configured, attribution will not work.

4. Configure single sign-on (optional)

This step is optional, but highly recommended.

Single Sign-On (SSO) helps to control team member access and to prevent unidentified apps from being created in your account.

To enable SSO, follow the steps in our guide.

FAQ

1. What happens to my users using an older version of my app?
   For users who haven't updated their app version to include the use of the protected endpoint, all data sent to Branch will be excluded from Advanced Compliance.
2. If I use a custom root domain, what happens to my app.link URLs?
   The app.link domain will continue to work, but newer links will be created using the custom root domain by default.
3. Which Branch SDKs can be used with Advanced Compliance?
   We currently support using Advanced Compliance alongside the Branch iOS, Android, Web, and React Native SDKs.
4. How do I know Advanced Compliance is secure?
   Our Advanced Compliance data architecture includes an isolated network with custom traffic routing, strong authentication, and multiple levels of encryption. Data will flow through a protected and isolated environment in which customer data is locked and subsequently available only where necessary.
5. How does HIPAA relate to Branch?
   While Branch isn't a “Covered Entity” under HIPAA regulations, HIPAA compliance relies on the safe handling of data by Business Associates as well. When Covered Entities expect their partners to process PHI in order to help meet their HIPAA compliance needs, Branch can assist in the role of a Business Associate and will provide a Business Associate Agreement (“BAA”).
6. What is PHI?
   Protected Health Information refers to any health related information combined with an identifier for a particular individual.
7. What data does Branch process?
   Branch, as a business associate, processes certain identifying data points (IDFA, I.P. Address, Device I.D., or other unique identifiers) on behalf of a "Covered Entity" customer in accordance with the BAA signed by both parties.
8. Can I use Branch with other marketing tools and ad networks?
   Through a sophisticated encryption and decryption process, Advanced Compliance supports integrations with ad networks and other marketing tools, as well as custom webhooks to internal systems.
   You are responsible for the configuration of your service and should review third party requirements before enabling any third party integration and directing Branch to send your data to a third party.