Privacy and Use Policy
Interim policy · Updated October 20, 2026
Interim policy. A formally reviewed policy is being tracked in GitHub issue #7. This page will be updated following that review.
These rules apply to the PSAP Report Hub. Access to a report does not grant permission to redistribute it.
For uploaders
- Submit only material you are authorized to share through this service.
- If anything is even potentially sensitive, do not submit or update it as Public. This includes report content, attachments, titles, descriptions, tags, and linked material. If in doubt, keep it private and seek approval.
- Private visibility does not override confidentiality, customer-data, security, or other applicable handling requirements. Do not upload material that this service is not authorized to hold.
- Review every update before publishing. Previously public copies may remain outside the hub even after removal.
For viewers
- Do not download, copy, or redistribute materials outside the approved sharing channels without express authorization from the content owner or another authorized approver.
- Share the report's hub link instead of exporting or forwarding its contents. Do not share sign-in credentials or access tokens to bypass access controls.
- The hub checks access to private reports when recipients open their links. Public reports are available without sign-in; sharing their links does not impose an identity check.
These are usage obligations, not a technical download-prevention feature. Any separately applicable license or explicit sharing authorization must also be respected.
Privacy: what we use and why
Google sign-in requests only openid email. The hub processes your email, verification status, Workspace domain, and identity-token claims to verify a redhat.com Workspace account and provide view-only access. It does not request Gmail, Drive, contacts, or profile access. Your email is displayed to you and included in a signed session cookie, not a separate Google user database. Google tokens are processed during sign-in, not intentionally stored in application storage or logged. Google sign-in data is not sold or used for advertising by the hub.
GitHub sign-in uses your username and organization membership or allowlist status. Publisher usernames, report content and metadata, access-token digests and administrative details, and operational logs are processed to run and secure the service. Logs may contain usernames, request paths, errors, and technical request information.
The hub is hosted on AWS, with application storage in US East (N. Virginia) and distributed CloudFront and Lambda@Edge request processing. Authorized administrators can access stored information for operation and support. Google and GitHub handle sign-in under Google's Privacy Policy and GitHub's Privacy Statement. Individual reports and external websites may use additional services under their own policies.
Cookies, retention, and your choices
The psap_auth cookie lasts up to one day for Google/GitHub or seven days for access-token sign-in. The Google security cookie psap_google_flow lasts up to ten minutes. Both are Secure, HttpOnly, SameSite=Lax, and signed, not encrypted. The hub does not install advertising or third-party analytics cookies.
Sign out to clear your session. You can also clear cookies and remove the hub from Google Account connections; revocation alone does not clear an existing hub session. Reports, revisions, metadata, and token records remain until administratively removed. Some operational logs have no configured automatic expiration. Contact the maintainers to request review, correction, or removal of stored information.
Contact and changes
For privacy questions or requests to review, correct, or remove stored information, contact thibrahi@redhat.com. Red Hat users can also reach the maintainers through #forum-psap on internal Slack. Do not include passwords, access tokens, or OAuth callback URLs in a request.
Changes to this policy will be posted on this page with an updated date.