Opensolr Information Security Policy

This document attempts to cover the Opensolr Data Security and Data Privacy policies that are already implemented and active. This is subject to change, so please check back for updates, or, Contact Us, with your suggestions.

1. Introduction

   1. The data flow that gets processed by and is stored by the Opensolr systems, is composed of 2 main components:
      1. Logical data
         1. Mainly composed of User Identification data, User Profile data.
         2. This data is used by Opensolr in order to provide users with the main Service Logic, which is the Solr Cloud Hosting Platform, along with it's adjacent services and user interfaces, that are accessible via RBAC (Role-Based-Access-Control) throughout the Service Platform Control Panel.
      2. Solr Data
         1. Consists of the data that the Opensolr Users, will host on the Opensolr Platform, in their own designated environment / server.
         2. This data is stored by Opensolr in datacenters worldwide, using third party hosting providers infrastructure, which includes, but may not be limited to the following partners, depending on prior user preference:
            1. AWS
            2. Hetzner
            3. HostHatch
            4. Alibaba Cloud

2. Confidentiality

   1. Both types of data defined above, are subject to our privacy policy.
   2. Logical Data, is securely stored on the Encrypted Opensolr Main Data Servers, located in the AWS Cloud infrastructure.
      1. This is the data that identifies an Opensolr User, either under a free, paid, or blocked status.
      2. User activity logs data, is the data generated by each user under the Logical Data, in order to provide complete transparency on every action taken inside each user's account. These logs are also stored on the Encrypted Opensolr Main Data Servers, located in the AWS Cloud infrastructure.
      3. The Logical Data is only available to the Opensolr Account Owner via the Opensolr Control Panel.
      4. The Opensolr Control Panel implements the following security policies:
         1. User/Password Authentication
         2. Two Factor Authentication, that may be enabled by each user, via Authy, or SMS
   3. Solr Data, is securely stored as defined at #1, in a datacenter and/or cloud platform of each user's choice.
      1. The Solr Data, implements the following security policies:
         1. SSL Data transmission
         2. HTTP Authentication
         3. IP Access Based Authorization
      2. The Solr Data, is only available to the Opensolr Account Owner User, and the user's team members.
         1. The team members are verified Opensolr Accounts, that the Opensolr Account Owner has approved and invited to manage the indexes within their account.
      3. The Solr Data is not made public, unless the Opensolr Account Owner explicitly asks or provides documentation, that it is OK to do so, only via our Support Helpdesk service, which also serves as a Non-Repudiation measure.

3. Integrity

   1. In order to maintain data integrity, the following policies are implemented:
      1. Logical Data (User Identity Data), may not be updated/removed or changed in any way, by any Opensolr Employee, except on the following scenarios:
         1. Account Owner explicitly requests such updates, via our Support Helpdesk service, which also serves as a Non-Repudiation measure.
         2. Account Owner makes such changes when updating personal information, using the Opensolr Control Panel, which also keeps a record of each change.
      2. Solr Data is only updated/deleted or otherwise changed by the Opensolr Account Owner, and the Team Members as described above, only after passing the implemented security policies.

4. Availability

   1. All Opensolr authorized users, have timely and easy access to the Opensolr Services at all times.
   2. The Opensolr infrastructure and built-in technologies, always ensure data and systems availability, even during adverse conditions, such as data systems failures, etc.
   3. Opensolr therefore provides the following risk mittigation measures and policies, in order to ensure High Availability and resiliency:
      1. Solr Data Backup management tools, that allows the Opensolr Users to create, download or restore the Solr Data or Solr Configuration of their hosted Solr Indexes.
      2. Solr Index Replication that enables the Opensolr Users to create direct replicas of each Index, into a different region worldwide, for High Availability and Data Redundancy
      3. Main Opensolr Systems replication and redundancy, worldwide, in order to provide High Availability of the Opensolr Control Panel, and the adjacent systems therein.
      4. Custom and Third Party WAF (Web Application Firewall) systems, such as Apache mod_security.

5. Authenticity

   1. Opensolr uses the most secure SSL standards and configurations in order to provide secure and authentic data transfers across the entire Opensolr ecosystem.
   2. Opensolr does not require nor transfer biometric, or location data.
   3. All data being transfered via the Opensolr ecosystem is subject to the following policies:
      
      1. WAF AI verification, blocking or whitelisting.
      2. SSL Security Keys and fingerprint verification of each data transfer via html form security keys, for verification of authentic transmissions.

6. Non-Repudiation

   1. Opensolr holds detailed logs and revisions of each important data transfer, that pertains to User Identification and User Actions.
   2. Opensolr holds detailed logs and revisions of each User support interaction via our Support Helpdesk System