Our mission is:
Help our users to secure themselves, OR, deliver security to the world, OR, Issue Free Certs!
OK, that's several views of the mission ... it is a future project to choose a long term sustainable mission!
We do not discriminate. We make our products available to all; if a segment of the users is disadvantaged then this is a bug.
All revenues are reviewed for openness and transparency.
We do not "sell" products, rather we cover our costs in helping the users to secure themselves.
We do not overtly compete with commercial firms. If they can do a better job, let them. If the product works better free, then let it be free. Our goal is not to destroy our competitors, but to help our users secure themselves.
We do not do secret deals. Access to our users may be negotiated, but it is requires a fully open and scrutinised agreement.
We strive to open up as many of our processes as possible. We strive to present our decisions, products and services as transparent.
We do not deceive. We disclose a fair and complete story. We do not hide our dirty washing. We engage our community in the dirty trade of security. We reveal our conflicts of interest, for our peers to judge.
In order to ensure the critical attention of an independent press and other critics, we do not ban others from writing about us. Their pen is their sword, ours is our Principles.
We train ourselves and our users to secure. We train our users to train other users.
If we accept someone in a role, we train, we test, and we support. The training is provided for free.
For our core community roles such as Assurer, sufficient quality training will be available for free. This does not preclude commercial services, but we do not aim to create a commercial franchise in training.
Where we make statements, we set standards.
Once a standard is set, we take it on ourselves to not let that standard slip over time. Each standard has meaning over time that can be relied upon by our users.
Our statements are not for sale for 30 pieces of silver.
We are focussed on the security of our own users, our own community.
In so far as outside interests can support us, then we may accept their help. In so far as outside interests threaten the security of our users, we are against them.
When we take on a job, we do it, until we can't. When we cannot do a job, we say so. When we run out of time, we organise a replacement.
We strive to provide security. This means that we cooperate in securing ourselves and others. As a principle, security is led by the Security Director, but it is our joint responsibility. Where we come into contact with security breaches, we disclose these.
We keep our disputes in-house. We strive to train our users, and where things go wrong, we address before a forum of peers.
You, and each user, are our ambassador to the rest of the world.
Present us fairly, "warts and all." Stress that we are open to new users. We seek no press, no papparazzi, no fleeting glories; our goal is to look after our own, not others.
While we work for the benefit of our own users, we must balance our benefit against harm to others. Achieving a benefit to ourselves at the expense of others has no part in our principles.
Other users may join, and they become of us. Even those who do not join are part of our neighbour's flock, and we do not drive them to the wolves in order to save our own flock.
These principles are incorporated into the Registered User Agreement by reference and thus are agreed by all. However, by nature, principles are not strongly defined and they require the use of judgement. In the event of abuse, disputes can be raised, with reference to the Principles, and the ruling of the Arbitrator will clarify.