Compliance

These pages give the information that European law asks of the parties that make, host and operate Fediversity.

• Threat model -- what Fediversity must protect, the trust boundaries, the controls in the code and the gaps that issues track.
• SBOM -- where CI publishes the SBOM of each node, how to find the SBOM of a commit, and what it describes.
• License decisions -- a recommendation for each license that the license matrix does not give, and the decisions of the maintainers.
• Data protection -- the GDPR roles of the actors, and the personal data that each application and service keeps, where and how long.
• Contract templates -- a data processing agreement and switching and exit clauses, with the annexes that the code fills in.
• Legal roles -- the roles of the parties under the Cyber Resilience Act, the Product Liability Directive and NIS2, the events that make a party a manufacturer, and the duties for the content of an instance under the Digital Services Act and the regulation on terrorist content online.
• Technical documentation -- the items of the technical documentation of the Cyber Resilience Act (Annex VII), and the document that covers each item.