Legal
Stewardship
- The Framework is maintained by Source Commons Lab as an open framework.
- Source Commons Lab is incorporated in Canada under corporation number 1807187-0.
- The framework is open source and will stay that way: its code and metadata are fully open on GitHub.
Hosting and security
Application data — accounts, Spaces, lists, discussions and published records — is hosted on Supabase in its Canadian region (AWS Canada Central), so it stays in Canada.
Supabase is SOC 2 Type II and ISO 27001 certified and HIPAA-compliant, encrypts all data at rest with AES-256 and in transit over TLS, and is audited annually by an independent third party.
Analytics and privacy
Traffic on this site is measured with PostHog. By default the measurement is cookieless: no identifier is stored on your device, and visits are not linked to one another across sessions.
PostHog Inc. acts as our processor. Analytics data is hosted in the United States under the EU-U.S. Data Privacy Framework, to which PostHog is certified. Measurement requests are routed through this domain rather than sent directly to a third-party domain.
The data is used to understand which pages and features are useful, to measure the contribution journey, and to diagnose errors. It is never sold, and never used for advertising or automated decision-making.
Analytics cookies and session replay are off until you enable them, and you may change or withdraw your choice at any time. You can also object to all measurement, including the cookieless baseline.
Account deletion
You can permanently remove access to your account from My account. This is a soft deletion: your authentication data is removed, while the immutable contributor ID is retained to preserve the integrity of the public record.
Published resources, comments, Spaces and lists remain online. Before deletion, you may also remove your public name and profile photo.