Initial certifications

[paulfitz]

There are some security-related certificates that some clients could benefit from, as an alternative to self-hosting Grist and dealing with compliance themselves. We should also confirm GDPR compliance.

[tfillmor924]

Being HIPAA and/or GDPR compliant is pretty critical for use in whatever industry one is in if there is PII included in the data. I
m in that situation. Being a Linux/systems guy I'm pretty sure I could self-host an install and make it near-compliant but I believe that it would make everyone feel better and more confident in a platform that already provides it.

Can you please respond with a status on this issue or if it's even being considered?

Thanks!

Tom
southern California

[vkuhlmann]

I think implementing and participating in the Data Privacy Framework [1] would go a long way towards achieving GDPR compliance. A certificate is nice, but in principle, if all necessary measures are taken, you are compliant.

At the moment, European users would not even be able to store e-mail addresses in their documents. Unless Grist Labs is doing sketchy stuff with our data, I think compliance is mostly a matter of reaffirming privacy committments, and legally capturing that commitment in [1] and stating them on the website. Certificates by an external independent party are nice, but if the process is very expensive, then just start with compliance itself! :)

[1] https://www.autoriteitpersoonsgegevens.nl/en/themes/international/transfer-within-and-outside-the-eea/personal-data-transfers-to-the-us