[mtuchi]

Short Description

Reworks the implementation security guidance around the six phases in the approved deck, and corrects the confusing or misleading claims from the first version of this PR.

Fixes https://github.com/OpenFn/ofg-services-internal/issues/131, https://github.com/OpenFn/ofg-services-internal/issues/138

Details

Facts were checked against OpenFn/lightning@3b9f4a2 and OpenFn/kit@5b42eff.

get-started/security.md: rewritten by phase

• Sections for Discovery, Project setup, Build, Integrated testing, Deployment and Operations, taken from the approved "Implementation Security Guidance" deck. Each section covers the risks, the practices, the OpenFn setting that puts each one in place (with links), and a phase-gate check.
• The 23 guidebook practices are folded into the phases. The guidebook slides, resources and templates are kept below.
• House style: no H1, no HTML lists, no skipped heading levels.
• Dropped the OpenHIE link. The old working-group page is gone, and the generic community page added earlier doesn't cover security.

get-started/security-compliance.md

• Credentials: removed "without seeing its secret values". Only the owner can view or edit secrets in the app (policies/users.ex), but an Editor's job code receives the values at runtime. Removed "purged when deleted", which I couldn't verify.
• Audit trail: plain language, and OpenFn Cloud users are told to contact support. Removed the personal access token sentence.
• MFA: requiring MFA depends on the plan (hooks.ex :limit_mfa).
• Zero persistence is no longer presented as a data-residency control. It controls storage, not where data is processed.

build-for-developers/security-for-devs.md

• Removed the advice to put real passwords in state.json. It now points to credentials, and to a credential map kept out of the repository for the CLI (the CLI doesn't gitignore it).
• console.log: removed the confusing "aspects of the sandbox" wording. Turning off Allow console.log() usage sets the job log level to none (run_with_options.ex), and adaptor and runtime logs still show. Merged the two duplicate bullets.
• Zero persistence: removed the residency framing, and added that retries stop working.

Related pages

• build/workflows.md: Editors can change the log setting (edit_workflow is an editor action), not only owners and admins.
• manage-projects/io-data-storage.md: replaced the "data sovereignty" claim with what zero persistence does, including that retries stop working and channel payloads aren't stored.
• get-started/implementation-checklist.md: links to the phase-based security page.

yarn generate-adaptors && yarn build passes for all locales, and these pages add no new broken-anchor warnings.

Left for later

• Spanish translations of these pages are now out of date. They need a /translate run in a separate PR.
• Deck claims not used because the code contradicts them: automatic PII masking (only credential values are scrubbed), in-memory processing with instant scrubbing, credentials isolated per environment by default, and "strict zero-persistence guarantees". The 14-slide deck needs correcting before it's used for training.
• Follow-up issues to file: document credential environments and keychain credentials as their own topic. In OpenFn/kit, the CLI could gitignore or warn about credential files. cli-sync.md mentions --credential-map, but the CLI option is --credentials (options.ts:285).
• House style in security-compliance.md (H1, em dashes) and the bold-label bullets in security-for-devs.md, left to keep this PR focused.

Questions

• Is a deleted credential purged immediately or scheduled for deletion? (Brandon's team)
• The Cloud SQL and AES-256 encryption claims can't be checked from code. (Brandon's team)
• Is there an official list of phase-gate questions, and is the 2022 Go-Live Checklist doc still the current template? The checks on the page are drawn from the approved deck. (Aleksa's team)
• healthdataprinciples.org and gicsandbox.org time out from scripts and need a check in a browser. digitalprinciples.org returns 403 to scripts.

AI Usage

• I have used Claude Code
• I have used another model
• I have not used AI

You can read more details in our
Responsible AI Policy

🤖 Generated with Claude Code