From d393f2981fb2b2eef2bbae5aec2df08d6baee390 Mon Sep 17 00:00:00 2001 From: phertyameen Date: Sat, 17 Oct 2026 02:54:23 +0100 Subject: [PATCH] Add export control, childrens data, audit assurance, and whistleblower compliance policies Closes #1879 Closes #1881 Closes #1882 Closes #1883 --- Governance/compliance/AUDIT_ASSURANCE.md | 77 +++++++++++++++++++ Governance/compliance/CHILDRENS_DATA.md | 75 +++++++++++++++++++ Governance/compliance/EXPORT_CONTROL.md | 87 ++++++++++++++++++++++ Governance/compliance/WHISTLEBLOWER.md | 94 ++++++++++++++++++++++++ 4 files changed, 333 insertions(+) create mode 100644 Governance/compliance/AUDIT_ASSURANCE.md create mode 100644 Governance/compliance/CHILDRENS_DATA.md create mode 100644 Governance/compliance/EXPORT_CONTROL.md create mode 100644 Governance/compliance/WHISTLEBLOWER.md diff --git a/Governance/compliance/AUDIT_ASSURANCE.md b/Governance/compliance/AUDIT_ASSURANCE.md new file mode 100644 index 00000000..194b2525 --- /dev/null +++ b/Governance/compliance/AUDIT_ASSURANCE.md @@ -0,0 +1,77 @@ +# Audit and Assurance Policy + +| Field | Value | +| --- | --- | +| Document | `Governance/compliance/AUDIT_ASSURANCE.md` | +| Status | Active | +| Version | 1.0.0 | +| Owner | Maintainer Team | +| Last reviewed | 2026-10-17 | +| Review cadence | Every 12 months | +| Applies to | Internal reviews and third-party assessments of the project's controls | +| Related | [`policies/TRANSPARENCY_REPORTS.md`](../policies/TRANSPARENCY_REPORTS.md) · [`SECURITY_POLICY.md`](../SECURITY_POLICY.md) · [`compliance/SANCTIONS.md`](SANCTIONS.md) | + +This policy describes how the project seeks assurance that its security, privacy, +and governance controls work — through internal review and, where warranted, +independent third-party assessment — and how the results are recorded and shared. + +## 1. What assurance covers + +- **Security controls:** authentication, authorisation, dependency hygiene, + secret rotation ([`policies/SECRET_ROTATION.md`](../policies/SECRET_ROTATION.md)), + and the vulnerability remediation clock + ([`policies/VULN_SLA.md`](../policies/VULN_SLA.md)). +- **Privacy controls:** data classification, retention, deletion, and consent, per + [`domains/DATA_CLASSIFICATION.md`](../domains/DATA_CLASSIFICATION.md), + [`domains/DATA_RETENTION.md`](../domains/DATA_RETENTION.md), and + [`policies/CONSENT_MANAGEMENT.md`](../policies/CONSENT_MANAGEMENT.md). +- **Governance controls:** decision-making, contribution records, licensing and + attribution, and sanctions/compliance screening. +- **Availability and change management:** release sign-off, rollback, and the + meeting/decision cadence. + +## 2. Levels of assurance + +| Level | Who performs it | Typical trigger | +| --- | --- | --- | +| **Self-assessment** | Maintainers and contributors | Routine, at least **every 12 months** per area | +| **Internal review** | A maintainer independent of the area under review | After a significant incident or a control change | +| **Independent third-party assessment** | An external assessor engaged by the project | Before a major release, on sponsor/grant request, or after a serious incident | + +- **Independence.** The reviewer of a control is not the person who built or + operates it. For internal review, "independent" means a maintainer with no + authorship of the area. +- **Proportionate effort.** The depth of an assessment matches the risk and the + size of the change; a small documentation change does not warrant a full + external audit. + +## 3. How an assessment is run + +1. **Scope.** Define the controls, systems, and period covered, and the standard + against which they are assessed. +2. **Evidence.** The assessor works from the actual repositories, configuration, + and records — not from assurances alone. +3. **Findings.** Each finding is recorded with a severity, so it can be tracked + like any other risk, and remediated under the relevant policy. +4. **Report.** The assessor produces a written report: scope, method, findings, + and limitations. +5. **Remediation.** Findings are tracked to closure with owners and dates; + Critical and High findings follow the escalation in + [`policies/VULN_SLA.md`](../policies/VULN_SLA.md) where security-related. + +## 4. Reporting and confidentiality + +- **What is shared publicly.** A summary of the assessment — scope, date, and + remediation status — is published in the appropriate parts of + [`policies/TRANSPARENCY_REPORTS.md`](../policies/TRANSPARENCY_REPORTS.md). +- **What stays private.** Exploitable detail, personal data, and anything that + would weaken security is **not** published until fixed; sensitive findings are + handled under [`SECURITY_POLICY.md`](../SECURITY_POLICY.md). +- **Records.** Reports and remediation evidence are retained in a restricted + location for the period needed to demonstrate due diligence, then disposed of. + +## 5. Change log + +| Date | Version | Change | +| --- | --- | --- | +| 2026-10-17 | 1.0.0 | Initial release. | diff --git a/Governance/compliance/CHILDRENS_DATA.md b/Governance/compliance/CHILDRENS_DATA.md new file mode 100644 index 00000000..6a6f32a4 --- /dev/null +++ b/Governance/compliance/CHILDRENS_DATA.md @@ -0,0 +1,75 @@ +# Children's Data Policy + +| Field | Value | +| --- | --- | +| Document | `Governance/compliance/CHILDRENS_DATA.md` | +| Status | Active | +| Version | 1.0.0 | +| Owner | Maintainer Team | +| Last reviewed | 2026-10-17 | +| Review cadence | Every 6 months | +| Applies to | Any processing of personal data relating to children | +| Related | [`policies/CONSENT_MANAGEMENT.md`](../policies/CONSENT_MANAGEMENT.md) · [`policies/PRIVACY_POLICY_GOVERNANCE.md`](PRIVACY_POLICY_GOVERNANCE.md) · [`policies/DATA_DELETION.md`](../policies/DATA_DELETION.md) | + +This policy sets what the project does when its service is used by, or its data +concerns, a child. It applies wherever the project determines the purposes of +processing; where a customer controls the data, the customer's obligations apply +and the project assists them. + +## 1. Is the service for children? + +- **Not directed at children by default.** The platform is intended for adult + learners and educators; it is not designed for, and does not solicit, users + below the applicable age of digital consent. +- **Age of consent differs by region.** The minimum age is the applicable age in + the user's jurisdiction — commonly **13** in some regions and up to **16** in + others. Where the two conflict, the higher protection applies. +- **No knowing collection.** The project does not knowingly collect personal data + from children below the applicable age without a valid lawful basis, normally + verifiable parental or guardian consent. +- **Age assurance, proportionately.** Where a feature could plausibly attract + younger users, the project uses proportionate age screening or self-declaration + rather than collecting more identity data than necessary. + +## 2. If children's data is involved + +- **Lawful basis.** Processing children's data requires a documented lawful + basis; where consent is the basis, it must be given or authorised by the holder + of parental responsibility and recorded per + [`policies/CONSENT_MANAGEMENT.md`](../policies/CONSENT_MANAGEMENT.md). +- **Data minimisation.** Collect the least children's data that the purpose + requires; do not use it for profiling, advertising, or any purpose unrelated to + the educational service. +- **No behavioural advertising** to children, and no sale of children's data. +- **Higher classification.** Children's data is treated as high-sensitivity under + [`domains/DATA_CLASSIFICATION.md`](../domains/DATA_CLASSIFICATION.md): access is + restricted to those who need it, storage is encrypted, and retention is + minimised. +- **Deletion.** A request to delete a child's data is handled promptly under + [`policies/DATA_DELETION.md`](../policies/DATA_DELETION.md), including a request + made by a parent or guardian. +- **Mental-health and wellbeing content** receives particular care: it does not + diagnose, and it points to qualified human support rather than standing alone. + +## 3. Discovery and remediation + +- **If we learn a child's data was collected without a basis**, we stop the + processing, notify the affected account or guardian, and delete the data, in + line with [`policies/DATA_DELETION.md`](../policies/DATA_DELETION.md). +- **Incident handling.** A suspected breach involving children's data is handled + as a security incident under [`SECURITY_POLICY.md`](../SECURITY_POLICY.md), with + notification decisions made promptly given the heightened risk. +- **Records.** The fact, nature, and resolution of a children's-data issue are + recorded in a restricted register for accountability. + +## 4. Review + +The maintainers review this policy at least **every 6 months**, and whenever the +platform adds a feature aimed at younger learners or a new region with a +different age threshold. + +## 5. Change log + +| Date | Version | Change | +| --- | --- | --- | +| 2026-10-17 | 1.0.0 | Initial release. | diff --git a/Governance/compliance/EXPORT_CONTROL.md b/Governance/compliance/EXPORT_CONTROL.md new file mode 100644 index 00000000..348897b2 --- /dev/null +++ b/Governance/compliance/EXPORT_CONTROL.md @@ -0,0 +1,87 @@ +# Export Control Policy + +| Field | Value | +| --- | --- | +| Document | `Governance/compliance/EXPORT_CONTROL.md` | +| Status | Active | +| Version | 1.0.0 | +| Owner | Maintainer Team | +| Last reviewed | 2026-10-17 | +| Review cadence | Every 12 months, and before adding a new dependency or distributing binaries | +| Applies to | The open-source codebase, its release artifacts, and project-funded distributions | +| Related | [`compliance/SANCTIONS.md`](SANCTIONS.md) · [`policies/LICENSING.md`](../policies/LICENSING.md) · `LICENSE` | + +This policy describes how the project thinks about export control and economic +sanctions as an open-source software project: what is distributed, the +cryptography that is shipped, and the sanctioned-party screening that applies to +project-sponsored activity. It is a compliance statement of intent, not legal +advice; where a legal question is live, the project seeks counsel. + +## 1. Scope and character of the project + +- **The project is open source.** Source code is published publicly under the + project's [`LICENSE`](../../LICENSE), which is available to everyone, including + persons in other countries. Most open-source code is **not subject to export + controls** for that reason, and this is the project's default posture. +- **What this policy reaches.** It applies to code, binaries, and technical data + that the project itself distributes or makes available, and to project-funded + transactions. It does not purport to regulate what independent users do with + the code. +- **No end-user restriction in the license.** Consistent with open-source + practice, the license does not discriminate against persons or groups. This + policy therefore governs the project's own conduct, not who may use the code. + +## 2. Cryptographic functionality + +- **The software uses cryptography.** It relies on standard cryptographic + primitives for transport security, password hashing, and token signing; it does + not implement novel or export-restricted strong encryption of its own beyond + what the chosen libraries provide. +- **Notification where required.** Because cryptographic software can trigger + export notification obligations in some jurisdictions, the project records the + cryptographic functionality in the dependency inventory and includes the + standard export notice in release metadata where a distribution channel + requires one. +- **No circumvention.** The project does not knowingly build or ship tooling + whose purpose is to circumvent export controls or sanctions. + +## 3. Sanctioned parties and restricted destinations + +- **Screening applies to project-funded activity.** Before the project enters a + paid relationship — a sponsorship, a grant, a paid contractor, or a hosted + service the project pays for — the counterparty is screened against the + applicable restricted-party and embargoed-destination lists, following + [`compliance/SANCTIONS.md`](SANCTIONS.md). +- **Contributions are not screened as transactions.** Accepting a public + contribution through the normal contribution process does not, by itself, + constitute a controlled export; the project follows + [`policies/DCO.md`](../policies/DCO.md) and + [`policies/CONTRIBUTOR_SIGNOFF.md`](../policies/CONTRIBUTOR_SIGNOFF.md) for + contributions. +- **Sponsorships are covered.** Sponsorship arrangements follow the screening and + disclosure rules in [`community/SPONSORSHIP.md`](../community/SPONSORSHIP.md). + +## 4. Dependencies and third-party components + +- **Inventory.** Third-party dependencies are tracked so their licenses and any + export-relevant functionality are known; see + [`policies/LICENSING.md`](../policies/LICENSING.md). +- **Escalation.** If a dependency is discovered to require export authorisation + for the project's distribution, the maintainers assess whether to keep, + replace, or gate it, and document the decision. + +## 5. Records and escalation + +- The maintainers review this policy at least **every 12 months**, and whenever a + new binary distribution, a new cryptographic dependency, or a new funded + relationship appears. +- Any concern that a project activity may implicate export controls or sanctions + is raised privately with the maintainers and, where appropriate, escalated + under [`processes/ESCALATION_PATH.md`](../processes/ESCALATION_PATH.md) before + the activity proceeds. + +## 6. Change log + +| Date | Version | Change | +| --- | --- | --- | +| 2026-10-17 | 1.0.0 | Initial release. | diff --git a/Governance/compliance/WHISTLEBLOWER.md b/Governance/compliance/WHISTLEBLOWER.md new file mode 100644 index 00000000..855af382 --- /dev/null +++ b/Governance/compliance/WHISTLEBLOWER.md @@ -0,0 +1,94 @@ +# Whistleblower Policy + +| Field | Value | +| --- | --- | +| Document | `Governance/compliance/WHISTLEBLOWER.md` | +| Status | Active | +| Version | 1.0.0 | +| Owner | Maintainer Team | +| Last reviewed | 2026-10-17 | +| Review cadence | Every 12 months | +| Applies to | Anyone who reports suspected misconduct in good faith | +| Related | [`CODE_OF_CONDUCT.md`](../CODE_OF_CONDUCT.md) · [`processes/ESCALATION_PATH.md`](../processes/ESCALATION_PATH.md) · [`SECURITY_POLICY.md`](../SECURITY_POLICY.md) | + +The project depends on people speaking up. This policy explains how to report +suspected wrongdoing, the protection a good-faith reporter receives, how reports +are handled, and how the project avoids retaliation. + +## 1. What can be reported + +- A breach of law or regulation in the project's activity. +- A serious breach of the [`CODE_OF_CONDUCT.md`](../CODE_OF_CONDUCT.md) or of a + project policy. +- Financial impropriety, misuse of funds, or a conflict of interest not + disclosed. +- A security, privacy, or safety risk that is being concealed or ignored. +- Abuse of a maintainer or contributor position, or retaliation against someone + who raised a concern. + +Genuine mistakes and disagreements over technical decisions are **not** +whistleblowing; those follow normal review and +[`processes/CONFLICT_RESOLUTION.md`](../processes/CONFLICT_RESOLUTION.md). + +## 2. How to report + +- **Preferred channel:** a private written report to the maintainers via the + confidential address published in + [`policies/COMMUNICATION_NORMS.md`](../policies/COMMUNICATION_NORMS.md), marked + "confidential." +- **Security matters:** if the concern involves a vulnerability or an active + breach, use [`SECURITY_POLICY.md`](../SECURITY_POLICY.md) instead, so the + response team can contain it. +- **If the concern involves a maintainer**, send the report to a maintainer who + is not implicated; the recipients of the confidential channel are listed there. +- **Include what you can:** what happened, when, who was involved, and any + evidence. A report is still worth making if some detail is missing; do not + delay to gather more. +- **Anonymous reports** are accepted and considered, though a named reporter + makes follow-up and protection easier. + +## 3. Protection for the reporter + +- **Good faith is the standard.** A report made honestly, even if it turns out to + be mistaken, is protected. A knowingly false report made to harm someone is + not. +- **Confidentiality.** The reporter's identity is kept confidential and shared + only with those who must know to handle the report, or where the law requires + it. +- **No retaliation.** No one may be demoted, excluded, discouraged, or otherwise + penalised for raising a concern or for taking part in an investigation. + Retaliation is itself a serious breach of this policy. +- **Open-source contributors** cannot be "dismissed," but the equivalent + protections apply: a good-faith reporter is not blacklisted from the project or + from review. + +## 4. How reports are handled + +1. **Acknowledge** receipt within **5 business days** where the reporter gave a + contact. +2. **Assess and route.** A maintainer with no conflict of interest reviews the + report and decides the path: a policy process, a security response, a conduct + process, or a referral to an external authority where appropriate. +3. **Investigate** fairly, giving the person concerned an opportunity to respond, + and keeping records confidential. +4. **Decide and act** under the applicable policy — for conduct matters, + [`CODE_OF_CONDUCT.md`](../CODE_OF_CONDUCT.md); for policies, + [`compliance/SANCTIONS.md`](SANCTIONS.md). +5. **Report the outcome** to the reporter to the extent confidentiality allows, + without disclosing the identities of others. +6. **Escalate where needed.** If no unconflicted maintainer exists, the report is + routed to an external advisor; see + [`processes/ESCALATION_PATH.md`](../processes/ESCALATION_PATH.md). + +## 5. Records and review + +- Reports, evidence, and outcomes are kept in a restricted register, retained + only as long as needed for accountability and legal obligation, then deleted. +- The maintainers review this policy at least **every 12 months**, and confirm + that the confidential channel is staffed and reaches an unconflicted recipient. + +## 6. Change log + +| Date | Version | Change | +| --- | --- | --- | +| 2026-10-17 | 1.0.0 | Initial release. |