Add export control, childrens data, audit assurance, and whistleblower compliance policies

Governance/compliance/AUDIT_ASSURANCE.md

@@ -0,0 +1,77 @@
+# Audit and Assurance Policy
+
+| Field | Value |
+| --- | --- |
+| Document | `Governance/compliance/AUDIT_ASSURANCE.md` |
+| Status | Active |
+| Version | 1.0.0 |
+| Owner | Maintainer Team |
+| Last reviewed | 2026-10-17 |
+| Review cadence | Every 12 months |
+| Applies to | Internal reviews and third-party assessments of the project's controls |
+| Related | [`policies/TRANSPARENCY_REPORTS.md`](../policies/TRANSPARENCY_REPORTS.md) · [`SECURITY_POLICY.md`](../SECURITY_POLICY.md) · [`compliance/SANCTIONS.md`](SANCTIONS.md) |
+
+This policy describes how the project seeks assurance that its security, privacy,
+and governance controls work — through internal review and, where warranted,
+independent third-party assessment — and how the results are recorded and shared.
+
+## 1. What assurance covers
+
+- **Security controls:** authentication, authorisation, dependency hygiene,
+  secret rotation ([`policies/SECRET_ROTATION.md`](../policies/SECRET_ROTATION.md)),
+  and the vulnerability remediation clock
+  ([`policies/VULN_SLA.md`](../policies/VULN_SLA.md)).
+- **Privacy controls:** data classification, retention, deletion, and consent, per
+  [`domains/DATA_CLASSIFICATION.md`](../domains/DATA_CLASSIFICATION.md),
+  [`domains/DATA_RETENTION.md`](../domains/DATA_RETENTION.md), and
+  [`policies/CONSENT_MANAGEMENT.md`](../policies/CONSENT_MANAGEMENT.md).
+- **Governance controls:** decision-making, contribution records, licensing and
+  attribution, and sanctions/compliance screening.
+- **Availability and change management:** release sign-off, rollback, and the
+  meeting/decision cadence.
+
+## 2. Levels of assurance
+
+| Level | Who performs it | Typical trigger |
+| --- | --- | --- |
+| **Self-assessment** | Maintainers and contributors | Routine, at least **every 12 months** per area |
+| **Internal review** | A maintainer independent of the area under review | After a significant incident or a control change |
+| **Independent third-party assessment** | An external assessor engaged by the project | Before a major release, on sponsor/grant request, or after a serious incident |
+
+- **Independence.** The reviewer of a control is not the person who built or
+  operates it. For internal review, "independent" means a maintainer with no
+  authorship of the area.
+- **Proportionate effort.** The depth of an assessment matches the risk and the
+  size of the change; a small documentation change does not warrant a full
+  external audit.
+
+## 3. How an assessment is run
+
+1. **Scope.** Define the controls, systems, and period covered, and the standard
+   against which they are assessed.
+2. **Evidence.** The assessor works from the actual repositories, configuration,
+   and records — not from assurances alone.
+3. **Findings.** Each finding is recorded with a severity, so it can be tracked
+   like any other risk, and remediated under the relevant policy.
+4. **Report.** The assessor produces a written report: scope, method, findings,
+   and limitations.
+5. **Remediation.** Findings are tracked to closure with owners and dates;
+   Critical and High findings follow the escalation in
+   [`policies/VULN_SLA.md`](../policies/VULN_SLA.md) where security-related.
+
+## 4. Reporting and confidentiality
+
+- **What is shared publicly.** A summary of the assessment — scope, date, and
+  remediation status — is published in the appropriate parts of
+  [`policies/TRANSPARENCY_REPORTS.md`](../policies/TRANSPARENCY_REPORTS.md).
+- **What stays private.** Exploitable detail, personal data, and anything that
+  would weaken security is **not** published until fixed; sensitive findings are
+  handled under [`SECURITY_POLICY.md`](../SECURITY_POLICY.md).
+- **Records.** Reports and remediation evidence are retained in a restricted
+  location for the period needed to demonstrate due diligence, then disposed of.
+
+## 5. Change log
+
+| Date | Version | Change |
+| --- | --- | --- |
+| 2026-10-17 | 1.0.0 | Initial release. |

Governance/compliance/CHILDRENS_DATA.md

@@ -0,0 +1,75 @@
+# Children's Data Policy
+
+| Field | Value |
+| --- | --- |
+| Document | `Governance/compliance/CHILDRENS_DATA.md` |
+| Status | Active |
+| Version | 1.0.0 |
+| Owner | Maintainer Team |
+| Last reviewed | 2026-10-17 |
+| Review cadence | Every 6 months |
+| Applies to | Any processing of personal data relating to children |
+| Related | [`policies/CONSENT_MANAGEMENT.md`](../policies/CONSENT_MANAGEMENT.md) · [`policies/PRIVACY_POLICY_GOVERNANCE.md`](PRIVACY_POLICY_GOVERNANCE.md) · [`policies/DATA_DELETION.md`](../policies/DATA_DELETION.md) |
+
+This policy sets what the project does when its service is used by, or its data
+concerns, a child. It applies wherever the project determines the purposes of
+processing; where a customer controls the data, the customer's obligations apply
+and the project assists them.
+
+## 1. Is the service for children?
+
+- **Not directed at children by default.** The platform is intended for adult
+  learners and educators; it is not designed for, and does not solicit, users
+  below the applicable age of digital consent.
+- **Age of consent differs by region.** The minimum age is the applicable age in
+  the user's jurisdiction — commonly **13** in some regions and up to **16** in
+  others. Where the two conflict, the higher protection applies.
+- **No knowing collection.** The project does not knowingly collect personal data
+  from children below the applicable age without a valid lawful basis, normally
+  verifiable parental or guardian consent.
+- **Age assurance, proportionately.** Where a feature could plausibly attract
+  younger users, the project uses proportionate age screening or self-declaration
+  rather than collecting more identity data than necessary.
+
+## 2. If children's data is involved
+
+- **Lawful basis.** Processing children's data requires a documented lawful
+  basis; where consent is the basis, it must be given or authorised by the holder
+  of parental responsibility and recorded per
+  [`policies/CONSENT_MANAGEMENT.md`](../policies/CONSENT_MANAGEMENT.md).
+- **Data minimisation.** Collect the least children's data that the purpose
+  requires; do not use it for profiling, advertising, or any purpose unrelated to
+  the educational service.
+- **No behavioural advertising** to children, and no sale of children's data.
+- **Higher classification.** Children's data is treated as high-sensitivity under
+  [`domains/DATA_CLASSIFICATION.md`](../domains/DATA_CLASSIFICATION.md): access is
+  restricted to those who need it, storage is encrypted, and retention is
+  minimised.
+- **Deletion.** A request to delete a child's data is handled promptly under
+  [`policies/DATA_DELETION.md`](../policies/DATA_DELETION.md), including a request
+  made by a parent or guardian.
+- **Mental-health and wellbeing content** receives particular care: it does not
+  diagnose, and it points to qualified human support rather than standing alone.
+
+## 3. Discovery and remediation
+
+- **If we learn a child's data was collected without a basis**, we stop the
+  processing, notify the affected account or guardian, and delete the data, in
+  line with [`policies/DATA_DELETION.md`](../policies/DATA_DELETION.md).
+- **Incident handling.** A suspected breach involving children's data is handled
+  as a security incident under [`SECURITY_POLICY.md`](../SECURITY_POLICY.md), with
+  notification decisions made promptly given the heightened risk.
+- **Records.** The fact, nature, and resolution of a children's-data issue are
+  recorded in a restricted register for accountability.
+
+## 4. Review
+
+The maintainers review this policy at least **every 6 months**, and whenever the
+platform adds a feature aimed at younger learners or a new region with a
+different age threshold.
+
+## 5. Change log
+
+| Date | Version | Change |
+| --- | --- | --- |
+| 2026-10-17 | 1.0.0 | Initial release. |

Governance/compliance/EXPORT_CONTROL.md

@@ -0,0 +1,87 @@
+# Export Control Policy
+
+| Field | Value |
+| --- | --- |
+| Document | `Governance/compliance/EXPORT_CONTROL.md` |
+| Status | Active |
+| Version | 1.0.0 |
+| Owner | Maintainer Team |
+| Last reviewed | 2026-10-17 |
+| Review cadence | Every 12 months, and before adding a new dependency or distributing binaries |
+| Applies to | The open-source codebase, its release artifacts, and project-funded distributions |
+| Related | [`compliance/SANCTIONS.md`](SANCTIONS.md) · [`policies/LICENSING.md`](../policies/LICENSING.md) · `LICENSE` |
+
+This policy describes how the project thinks about export control and economic
+sanctions as an open-source software project: what is distributed, the
+cryptography that is shipped, and the sanctioned-party screening that applies to
+project-sponsored activity. It is a compliance statement of intent, not legal
+advice; where a legal question is live, the project seeks counsel.
+
+## 1. Scope and character of the project
+
+- **The project is open source.** Source code is published publicly under the
+  project's [`LICENSE`](../../LICENSE), which is available to everyone, including
+  persons in other countries. Most open-source code is **not subject to export
+  controls** for that reason, and this is the project's default posture.
+- **What this policy reaches.** It applies to code, binaries, and technical data
+  that the project itself distributes or makes available, and to project-funded
+  transactions. It does not purport to regulate what independent users do with
+  the code.
+- **No end-user restriction in the license.** Consistent with open-source
+  practice, the license does not discriminate against persons or groups. This
+  policy therefore governs the project's own conduct, not who may use the code.
+
+## 2. Cryptographic functionality
+
+- **The software uses cryptography.** It relies on standard cryptographic
+  primitives for transport security, password hashing, and token signing; it does
+  not implement novel or export-restricted strong encryption of its own beyond
+  what the chosen libraries provide.
+- **Notification where required.** Because cryptographic software can trigger
+  export notification obligations in some jurisdictions, the project records the
+  cryptographic functionality in the dependency inventory and includes the
+  standard export notice in release metadata where a distribution channel
+  requires one.
+- **No circumvention.** The project does not knowingly build or ship tooling
+  whose purpose is to circumvent export controls or sanctions.
+
+## 3. Sanctioned parties and restricted destinations
+
+- **Screening applies to project-funded activity.** Before the project enters a
+  paid relationship — a sponsorship, a grant, a paid contractor, or a hosted
+  service the project pays for — the counterparty is screened against the
+  applicable restricted-party and embargoed-destination lists, following
+  [`compliance/SANCTIONS.md`](SANCTIONS.md).
+- **Contributions are not screened as transactions.** Accepting a public
+  contribution through the normal contribution process does not, by itself,
+  constitute a controlled export; the project follows
+  [`policies/DCO.md`](../policies/DCO.md) and
+  [`policies/CONTRIBUTOR_SIGNOFF.md`](../policies/CONTRIBUTOR_SIGNOFF.md) for
+  contributions.
+- **Sponsorships are covered.** Sponsorship arrangements follow the screening and
+  disclosure rules in [`community/SPONSORSHIP.md`](../community/SPONSORSHIP.md).
+
+## 4. Dependencies and third-party components
+
+- **Inventory.** Third-party dependencies are tracked so their licenses and any
+  export-relevant functionality are known; see
+  [`policies/LICENSING.md`](../policies/LICENSING.md).
+- **Escalation.** If a dependency is discovered to require export authorisation
+  for the project's distribution, the maintainers assess whether to keep,
+  replace, or gate it, and document the decision.
+
+## 5. Records and escalation
+
+- The maintainers review this policy at least **every 12 months**, and whenever a
+  new binary distribution, a new cryptographic dependency, or a new funded
+  relationship appears.
+- Any concern that a project activity may implicate export controls or sanctions
+  is raised privately with the maintainers and, where appropriate, escalated
+  under [`processes/ESCALATION_PATH.md`](../processes/ESCALATION_PATH.md) before
+  the activity proceeds.
+
+## 6. Change log
+
+| Date | Version | Change |
+| --- | --- | --- |
+| 2026-10-17 | 1.0.0 | Initial release. |

Governance/compliance/WHISTLEBLOWER.md

@@ -0,0 +1,94 @@
+# Whistleblower Policy
+
+| Field | Value |
+| --- | --- |
+| Document | `Governance/compliance/WHISTLEBLOWER.md` |
+| Status | Active |
+| Version | 1.0.0 |
+| Owner | Maintainer Team |
+| Last reviewed | 2026-10-17 |
+| Review cadence | Every 12 months |
+| Applies to | Anyone who reports suspected misconduct in good faith |
+| Related | [`CODE_OF_CONDUCT.md`](../CODE_OF_CONDUCT.md) · [`processes/ESCALATION_PATH.md`](../processes/ESCALATION_PATH.md) · [`SECURITY_POLICY.md`](../SECURITY_POLICY.md) |
+
+The project depends on people speaking up. This policy explains how to report
+suspected wrongdoing, the protection a good-faith reporter receives, how reports
+are handled, and how the project avoids retaliation.
+
+## 1. What can be reported
+
+- A breach of law or regulation in the project's activity.
+- A serious breach of the [`CODE_OF_CONDUCT.md`](../CODE_OF_CONDUCT.md) or of a
+  project policy.
+- Financial impropriety, misuse of funds, or a conflict of interest not
+  disclosed.
+- A security, privacy, or safety risk that is being concealed or ignored.
+- Abuse of a maintainer or contributor position, or retaliation against someone
+  who raised a concern.
+
+Genuine mistakes and disagreements over technical decisions are **not**
+whistleblowing; those follow normal review and
+[`processes/CONFLICT_RESOLUTION.md`](../processes/CONFLICT_RESOLUTION.md).
+
+## 2. How to report
+
+- **Preferred channel:** a private written report to the maintainers via the
+  confidential address published in
+  [`policies/COMMUNICATION_NORMS.md`](../policies/COMMUNICATION_NORMS.md), marked
+  "confidential."
+- **Security matters:** if the concern involves a vulnerability or an active
+  breach, use [`SECURITY_POLICY.md`](../SECURITY_POLICY.md) instead, so the
+  response team can contain it.
+- **If the concern involves a maintainer**, send the report to a maintainer who
+  is not implicated; the recipients of the confidential channel are listed there.
+- **Include what you can:** what happened, when, who was involved, and any
+  evidence. A report is still worth making if some detail is missing; do not
+  delay to gather more.
+- **Anonymous reports** are accepted and considered, though a named reporter
+  makes follow-up and protection easier.
+
+## 3. Protection for the reporter
+
+- **Good faith is the standard.** A report made honestly, even if it turns out to
+  be mistaken, is protected. A knowingly false report made to harm someone is
+  not.
+- **Confidentiality.** The reporter's identity is kept confidential and shared
+  only with those who must know to handle the report, or where the law requires
+  it.
+- **No retaliation.** No one may be demoted, excluded, discouraged, or otherwise
+  penalised for raising a concern or for taking part in an investigation.
+  Retaliation is itself a serious breach of this policy.
+- **Open-source contributors** cannot be "dismissed," but the equivalent
+  protections apply: a good-faith reporter is not blacklisted from the project or
+  from review.
+
+## 4. How reports are handled
+
+1. **Acknowledge** receipt within **5 business days** where the reporter gave a
+   contact.
+2. **Assess and route.** A maintainer with no conflict of interest reviews the
+   report and decides the path: a policy process, a security response, a conduct
+   process, or a referral to an external authority where appropriate.
+3. **Investigate** fairly, giving the person concerned an opportunity to respond,
+   and keeping records confidential.
+4. **Decide and act** under the applicable policy — for conduct matters,
+   [`CODE_OF_CONDUCT.md`](../CODE_OF_CONDUCT.md); for policies,
+   [`compliance/SANCTIONS.md`](SANCTIONS.md).
+5. **Report the outcome** to the reporter to the extent confidentiality allows,
+   without disclosing the identities of others.
+6. **Escalate where needed.** If no unconflicted maintainer exists, the report is
+   routed to an external advisor; see
+   [`processes/ESCALATION_PATH.md`](../processes/ESCALATION_PATH.md).
+
+## 5. Records and review
+
+- Reports, evidence, and outcomes are kept in a restricted register, retained
+  only as long as needed for accountability and legal obligation, then deleted.
+- The maintainers review this policy at least **every 12 months**, and confirm
+  that the confidential channel is staffed and reaches an unconflicted recipient.
+
+## 6. Change log
+
+| Date | Version | Change |
+| --- | --- | --- |
+| 2026-10-17 | 1.0.0 | Initial release. |