On the whole, does this project take steps to ensure that it anticipates, prevents and does no harm by design?

Yes

Is there any additional information you would like to share about the mechanisms, processes or policies that this project uses to avoid doing harm by design?

Internal security review of all code and regular 3rd party security audits.

Does this project collect or store personally identifiable information (PII) data and/or content?

Yes

If yes - please list the types of data and/or content collected and/or stored by the project:

• Uwazi only uses cookies for users that log in into the platform, for example, to upload content into the instance.
• We might also use third party cookies, on the request of a partner, for example, Google Analytics.
• We collect IP address information for security reasons and statistical analysis of the traffic, and keep an access log during 3 months.
• Uwazi is often used to record and manage information about human rights violations, but this information is accessible only to the organisations managing a respective collection.

If yes - does this project share this data and/or content with third parties?

Yes

Please describe the circumstances with which this project shares data and/or content with third parties. Please add links as relevant.

• Hosting and processing: the HURIDOCS Websites and HURIDOCS Applications/Tools are hosted by third party service providers and therefore any personal details you submit through a HURIDOCS Website and/or HURIDOCS Applications/Tools may be processed by that third party service provider. We may also use other third parties to process your personal details. For example, such third parties may process your personal information to process donations to HURIDOCS on our behalf or process and forward mailing information for users to sign up to our online actions and/or choose to subscribe to our email updates. All of these third party services providers will process your personal information only on HURIDOCS’ behalf and will be bound by strict confidentiality conditions. Link: https://huridocs.org/privacy-policy/

If yes - does the project ensure the privacy, security and integrity of this data and/or content collection and has it taken steps to prevent adverse impacts resulting from its collection, storage and distribution.

Yes

If yes - please describe the steps, and include a link to the privacy policy and/or terms of service:

Uwazi only uses cookies for users that log in into the platform, for example, to upload content into the instance. We might also use third party cookies, on the request of a partner, for example, Google Analytics. We collect IP address information for security reasons and statistical analysis of the traffic, and keep an access log during 3 months. For more details visit the Cookies Policy - https://huridocs.org/cookies-policy/

Does this project collect, store or distribute content?

Yes

If yes - what kinds of content does this project, collect, store or distribute? (i.e. childrens books)

Human rights documentation (information on human rights violations, general human rights information, legal documents, court cases, academic resources, legal resources, photos, audio files, videos and other information that users see fit to upload to their collections.

If yes - does this project have policies that describe what is considered innappropriate content? (i.e. child sexual abuse materials)

No

If yes - please link to the relevant policy/guidelines/documentation.

Not Applicable

If yes - does this project have policies and processes for detecting and moderating innappropriate/illegal content?

Yes

If yes - please describe the policies and processes for detecting, reporting and removing innapropriate/illegal content (Please include the average response time for assessment and/or action. Link to any policies or descriptions of how inappropriate content is handled):

Since we work with human rights organisations, we anticipate that this is taken care of by selecting who we work with.

Does this project facilitate interactions with or between users or contributors?

Yes

If yes - does the project take steps to address the safety and security of underage users?

Yes

If yes - please describe the steps this project takes to address risk or prevent access by underage users:

• We have provided an email address for reporting abuse, harassment or improper conduct. This goes directly to our Chief Technology Officer and Director of Programmes, who will review and investigate any issues further.

If yes - does the project help users and contributors protect themselves against grief, abuse, and harassment?

Yes

If yes - please describe the steps taken to help users protect themselves.

• Contributor Covenant Code of Conduct - https://github.com/huridocs/uwazi/blob/development/CODE_OF_CONDUCT.md
• We have provided an email address for reporting abuse, harassment or improper conduct. This goes directly to our Chief Technology Officer and Director of Programmes, who will review and investigate any issues further.