Does Pega during BIX extract uses tls while transferring the file to external file location?
If yes, What settings it relies on for on-prem and can I see internal config or any evidence for auditing purposes?
Generally, BIX will generate the files in pegacloudrepository, and to send the files to external location, we need to do a connect-ftp method using an ftp server instance. The FTP server instance specifies the transfer protocol.
sftp, ftps and ftp protocols are supported although ftp is not really recommended due to lower security.
You can read more about the documentation here..
Thanks for your response. If its on-Prem and we provide output as external file directory , how Pega transmitting the file OOTB?
No, my understanding is - if you are doing a direct file transfer via bix rule(using a remote file path), it is treated like a local file transfer and the pega service user needs to have read/write access to the remote file system(I am assuming you have already set this up) and there is no network transport protocol involved that would utilize TLS. However, if you are using a network mount drive, sometimes there maybe a built in encryption setup on the drive, please check this with your NAT admin if this is the case.
To secure your transfer, you can consider alternative approaches - for example, allow BIX to write to a secured local temporary directory, and then immediately route the file using a Pega activity executing a Secure FTP (SFTP) or FTPS data instance to move it securely across your enterprise network
BIX itself does not provide TLS encryption for the extract file. The security depends on how the file is transferred after BIX generates it.
BIX → SFTP server (most common): This is not TLS; it is SSH-based encryption.
BIX → FTPS server: If the FTP Server rule is configured for FTPS, then Pega uses SSL/TLS.
Essentially BIX generates the file locally. During transmission, encryption depends on the transfer protocol configured in the FTP Server rule. When configured with SFTP, the file is transmitted over an encrypted SSH channel using configured authentication profiles and optional host/client keys. When configured with FTPS, the transfer is protected using SSL/TLS with configurable truststores, keystores, and TLS settings.
If the BIX extract output location is a network drive / shared file system, then the answer will depend on the network filesystem protocol, not on BIX.