Cisco Jabber Privacy

Category: Information Technology
Responsible Office: Information Security Office
Responsible Executive: Vice President and Chief Information Officer (VPCIO)
Date Established: October 9, 2018
Date Last Updated: February 17, 2023

Using Cisco Jabber on a university-owned workstation or device generates data to which there are data privacy implications. This document identifies the type of data stored in Cisco Jabber , who has access to that data, and how customers may adjust Cisco Jabber’s data privacy settings.

Back to Top

Cisco Jabber stores systems, clients, and usage data. This data is used for systems operation, management, planning, and troubleshooting. This data is not available to unauthorized individuals.

Data collected includes, but is not limited to:

• Client connection logging
  • Accounts and/or devices connecting to systems
  • Client software versions
  • Device type(s)
  • Date and time access is granted or attempted
• Voice and video call detail records
  • Accounts and/or devices originated or terminated a call attempt
  • Sources and destinations
  • Date, time, and length of call
  • Resources invoked and other call properties (codec, signaling details, servicing equipment)

Cisco Jabber Instant Messaging (IM) and Presence services maintain centrally stored rosters. A roster is a personally curated contact list. The roster is available from any device when using IM or Presence services. IM and Presence services must store roster information to operate normally. UBIT does not disclose roster information.

Only upon departmental directive, UBIT may automatically push roster listings. Automated roster updates do not view a customer’s roster. Other than automated roster updates, UBIT does not modify rosters.

By default, university customers can add other university customers to their rosters. Rosters provide presence status and reachability. However, privacy controls are available to restrict visibility of presence status and chat contact. The privacy controls do not block telephony or other means of communication.

IM and Presence Service buffers messages sent to offline accounts. Buffering makes chatting more convenient, because messages can be sent to a contact who is away from the system, or who is accessing the system from multiple devices.

Buffered messages are stored in clear text within the IM and Presence service application database. Buffered messages are cleared upon delivery or when the account is no longer valid. A maximum of 100 messages are buffered per account. Messages are stored for the necessary operation of the system and its features. UBIT does not report or provide offline message data.

Cisco Jabber is configured to provide Managed File Transfer. This allows customers to send and receive files while using the service.

Managed File Transfer automatically collects metadata about files transferred, sender, receiver, and file names. Metadata is only accessible by authorized system administrators and the IM and Presence service. Files and metadata are stored encrypted at rest. Files and metadata are erased after 14 days. UBIT does not report or share this data.

Performance monitoring and system usage data is available for systems monitoring and capacity planning purposes. The following information is not inspected:

• File or message content
• Accounts generating content

The following information is not included in performance and usage data:

• File or message content
• Accounts generating content

Files that require persistence outside of a conversation, or contain sensitive data, should be shared using secure file-sharing platforms and not through Cisco Jabber. UBIT recommends UBbox for sharing and storing sensitive or persistent data pursuant to the policies, guidelines, and procedures supplied with that service. For more information, refer to the UBbox Service Guide.

Back to Top

• Chat history is stored after participants close the chat window.
• Chat history is stored until participants sign out of the service.
• For Cisco Jabber for Mac, if you select the Save chat archives to option in the Chat Preferences window, chat history is stored locally in the Mac file system and can be searched using Spotlight.

Cisco Jabber does not encrypt archived instant messages with local chat history. For desktop clients, you can restrict access to chat history by saving archives to the following directories:

Windows: %USERPROFILE%\AppData\Local\Cisco\Unified Communications\Jabber\CSF\History\uri.db

Mac: ~/Library/Application Support/Cisco/Unified Communications/Jabber/CSF/History/uri.db

For mobile clients, the chat history files are not accessible. Mobile clients do not encrypt archived instant messages stored locally. Disable local chat history if you do not want unencrypted messages to be stored locally.

Customers log or save chats locally for reference or retrieval. This option is disabled by default.

Cisco Jabber for Windows customers can toggle this option under the chat settings by checking the box for Autosave each chat when closing the conversation.  The default storage location is C:\Program Files (x86)\Cisco Systems\Cisco Jabber\MyJabberChats

Cisco Jabber for Mac customers can toggle this option by selecting Save chat archives to: in the chat preferences:

Customers may select an alternative location to save chats. In some instances, the default location may be redirected to central storage or other backup systems.

Cisco Jabber for Desktop may record chat history to Microsoft Exchange, providing a convenient and searchable history of chats. This option is disabled by default. 

On Cisco Jabber for Windows, in the Outlook tab of preferences, select Save chat sessions to 'Cisco Jabber Chats' folder in Microsoft Outlook. The system is set to use the same credentials you use in order to log into the system. 

On Cisco Jabber for Mac, in the Chats preferences, select Save chat sessions to 'Cisco Jabber Chats' folder in Microsoft Outlook.

Customers may need to erase files stored at the above listed locations should their client be removed from the workstation, or should the client malfunction and require re-installation. Data not managed by the current operating installation of Cisco Jabber is not cleaned up by settings or preferences.

Cisco Jabber for Desktop may record chat history to Microsoft Exchange, providing a convenient and searchable history of chats. This option is disabled by default.

On Cisco Jabber for Windows, in the Outlook tab of preferences, select Save chat sessions to 'Cisco Jabber Chats' folder in Microsoft Outlook. The system is set to use the same credentials to log into the system.

On Cisco Jabber for Mac, in the Chats preferences, select Save chat sessions to 'Cisco Jabber Chats' folder in Microsoft Outlook.

Customers may need to erase files stored at the above listed locations should their client be removed from the workstation or should the client malfunction and require re-installation. Data not managed by the current operating installation of Cisco Jabber is not cleaned up by settings or preferences.

Files received through Cisco Jabber are stored locally. Customers manage and dispose of files as they see fit. Customers may periodically wish to review and purge files.

• Images are automatically accepted and downloaded to the file download location
• Other files require the customer to accept the file or download it purposefully

On Cisco Jabber for Windows, files are received to MyJabberFiles, located in the Chat archive location specified in Chat settings.

On Cisco Jabber for Mac, files are received to Downloads within the Mac file system.

Jabber for Mobile files are stored based on device settings and preferences.

Cisco Jabber is FIPS 140-2 capable, however, these capabilities are enforced by the operating system with Cisco Jabber for Windows. If FIPS is enabled on the platform, Jabber will also use FIPS, and will display an icon to indicate the client is operating in FIPS mode.

Cisco Jabber for Mobile can only use FIPS when using Enterprise Mobility Management software.

Preference data and logs are stored with client configuration information under:

Windows: %USERPROFILE%\AppData\Local\Cisco\Unified Communications\Jabber\

Mac: ~/Library/Application Support/Cisco/Unified Communications/Jabber/

When the client is "reset," or the client is cleared/re-installed, most of this information is removed or erased, however, orphaned files may exist at the above locations.

• Rosters belong to individual accounts within premise systems
• Rosters are not shared
• Network and Communications Systems does not report rosters or contents
• Rosters are automatically reviewed periodically to expunge invalid or expired contacts
• Enterprise Groups are managed by the group owner
• Group owners are responsible for manage group membership and content

• Cisco Jabber enables you to see the presence of other customers
• Presence is visible once a customer is added to your roster
• To prevent a customer from seeing your presence status, add them to the Block List in Privacy preferences
• If you choose to "Block Everyone," you must add the contacts with whom you wish to share presence status to your roster explicitly
• Customers added through Enterprise Groups are not automatically accepted for presence sharing

Cisco Jabber and other applicable clients connect to the IM and Presence Service using Transport Layer Security (TLS) to secure XMPP traffic between the client and server (C2S). Within the TLS transport, messages are encrypted using 256-bit AES encryption.

All Jabber clients connect securely through the Cisco Expressway collaboration edge. This secured transport then connects to the IM and Presence Service.

Customers may block Cisco Jabber contacts. Blocking prevents Presence and Instant Message interaction. Blocking does not restrict telephony, email, or other forms of contact.

By default, Cisco Jabber will prompt when an external contact wishes to reach you. You may adjust this preference to "Block Everyone" externally. When this option is selected, only those contacts which you have explicitly allowed may reach out to you via chat.

Additionally, you may “Block Everyone” for chats within the buffalo.edu presence domain, however, doing so may have undesired effects. You must curate an “Allow List” or add customers to your contact list. Customers populated from Enterprise Groups are not automatically considered "allowed" and must be added explicitly if you make this change.

The university uses open federation to allow external participants the opportunity to contact you. However, this may, result in Instant Messaging spam. You must block these unwanted contacts individually, or simply ignore them.

Voice and video calls within the university's data network systems are not encrypted.

Media between Cisco Jabber and the Cisco Expressway collaboration edge is encrypted. This secures traffic over TLS v1.2 between Cisco Jabber and border systems. Media encryption is backlogged for general availability. If there is a requirement for general media encryption or end-to-end encryption between Jabber and premise-based phones and devices between IP Phones or within the university's data network, please contact Network and Communications Systems.

Customers can save copies of information files exchanged through n and files exchanged through Cisco Jabber. This includes, but is not limited to an account profile, chat conversations, files exchanged, etc.

The university cannot limit the storage or reception of data exchanged through e or reception of data exchanged through Cisco Jabber.

Customers should use discretion when transmitting protected or private data. This will mitigate the risk of n transmitting protected or private data. This will mitigate the risk of unauthorized access to protected or private data. When using Instant Message or s to protected or private data. When using Instant Message or Presence with remote systems customers, these remote systems may not support TLS security. Therefore, conversational data may not be sufficiently secured or encrypted.

Customers are advised to use end-to-end secured services such as d-to-end secured services such as UBbox to interact with external participants if transmitting protected or private data.

Back to Top

Back to Top