- legal-discuss - lists.openstack.org

Legal Considerations for VPS / Cloud Hosting Providers in Terms of User Data & Compliance
by virtualassistantguybd＠gmail.com 16 Sep '25

16 Sep '25

Hello Legal-Discuss members, I hope you’re all doing well. I’m writing to open a discussion about legal requirements and best practices that VPS / cloud hosting providers (like those offering virtual private servers, dedicated servers, etc.) should follow concerning user data, service agreements, and regulatory compliance. I operate in the hosting industry and want to ensure that our processes are aligned with legal expectations globally and in specific jurisdictions (for instance data protection laws, acceptable use policies, etc.). Here are a few points I’d like to cover and get feedback on: What are the essential elements that must be included in a Hosting Provider’s Terms of Service (ToS) / Service Level Agreement (SLA), considering liabilities, user privacy, data retention, and breach notification? How do different jurisdictions (EU GDPR, US state laws, possibly Asia) treat data stored on VPS/cloud servers, especially user data that might be personal or sensitive? What obligations should a hosting provider anticipate? What best practices exist for ensuring legal compliance related to: Logging and monitoring user actions Handling abuse and takedown requests Data encryption & backups Dispute resolution Are there known legal precedents or cases (in any major jurisdiction) where a hosting provider was held liable for user content or abuse that occurred on their servers? What are the risks of using third-party infrastructure or tools (e.g. cloud platforms, backend APIs) that may affect liability or compliance? I’d appreciate insights, resources, or examples from members who have direct experience with these matters. If people have template clauses or policy examples that can be shared (where permitted), that would be very helpful. Thank you all for your time, and I look forward to learning from your collective expertise. Best regards, Atal Networks official team website url https://atalnetworks.com/

1 0

[administrivia] Recent change in moderation for new subscribers
by Jeremy Stanley 27 Mar '25

27 Mar '25

Due to a spammer subscribing to legal-discuss earlier today in order to send off-topic messages to the list, I've altered the default behavior for posts from new subscribers. For now, if someone subscribes, their initial post to the list will be held for moderation in order for our moderators to make sure it's a legitimate post, before setting their subscription to bypass moderation for any subsequent posts they make. Note that this only affects new subscriptions as of now, anyone who has already subscribed to the list before now should see no change in how things work for them. As for the spam to the list today, I've blocked that subscriber from sending any new messages and deleted their off-topic posts from the public archive. Please let me know if you have any questions. -- Jeremy Stanley

1 0

Apache license header in Puppet manifests
by Francesco Di Nucci 06 Mar '25

06 Mar '25

Hi all, the PR 943232 to puppet-horizon led to an interesting IRC discussion with Takashi and Tobias about the (not) usage of the Apache license header in Puppet manifests. Actually the OpenStack puppet-* modules have the LICENSE file and almost all the Puppet manifests do NOT have an header on top to state the license. On one hand Apache license help <https://www.apache.org/legal/apply-license.html#new> states that "Each original source document (code and documentation, but not the LICENSE and NOTICE files) should include a short license header at the top"; on the other hand a lot of Puppet modules on the Forge seems to not use it (including Puppetlabs' and Puppet's). Are we missing something in interpreting the license or should we add the license header on top of all files? Thanks in advance -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email:francesco.dinucci@na.infn.it

3 4

We need the last modification date in the CoC
by Alvaro Soto 20 Nov '24

20 Nov '24

Hi all, I personally believe it'll be a good idea to have the last modification date in our CoC [1]. It's hard to know if has been modified and if we need to read it again to understand the changes. From my end, I need to have this information to translate the changes to my local community. [1] https://openinfra.dev/legal/code-of-conduct How can we work this out? Cheers.

2 2

[administrivia] Recent spam on this list
by Jeremy Stanley 09 Oct '24

09 Oct '24

A spammer subscribed and sent several messages to the list in the past few minutes. I've blocked them from sending any further messages and deleted the initial ones from the list archive. If the problem resurfaces with additional users, I'll switch the list to initially moderate new subscribers or even just set it fully moderated (this particular mailing list gets so little traffic that it wouldn't impede discussion that much anyway). -- Jeremy Stanley

1 0

LICENSE question - Openstack Masakari
by Michal Arbet 15 Aug '24

15 Aug '24

Hello, I would like to implement the option to use the OpenStack project Masakari together with HashiCorp Consul. Currently, Corosync is used, but it has a limitation of 32 hosts. However, my question is, if I develop a way to build the image (OpenStack project Kolla) and orchestration (OpenStack project Kolla-Ansible) of the Consul project as a necessary tool in connection with Masakari, is it possible to merge such code? I am asking because Consul is under the BSL 1.1 license and according to https://governance.openstack.org/tc/reference/licensing.html, such questions need to be consulted on this mailing list. Consul license https://github.com/hashicorp/consul/blob/main/LICENSE The BSL 1.1 text includes the sentence: "The Licensor hereby grants you the right to copy, modify, create derivative works, redistribute, and make non-production use of the Licensed Work. The Licensor may make an Additional Use Grant, above, permitting limited production use." and in the Consul License, this passage is defined as follows: Additional Use Grant: You may make production use of the Licensed Work, provided Your use does not include offering the Licensed Work to third parties on a hosted or embedded basis in order to compete with HashiCorp's paid version(s) of the Licensed Work. For purposes of this license: Does this mean that it meets the requirements of OpenStack Governance? Even though it is not an OSI-approved license? Thank you very much Michal Arbet Openstack Engineer Ultimum Technologies a.s. Na Poříčí 1047/26, 11000 Praha 1 Czech Republic +420 604 228 897 michal.arbet(a)ultimum.io *https://ultimum.io <https://ultimum.io/>* LinkedIn <https://www.linkedin.com/company/ultimum-technologies> | Twitter <https://twitter.com/ultimumtech> | Facebook <https://www.facebook.com/ultimumtechnologies/timeline>

4 9

CoC translation to Spanish
by Alvaro Soto 07 Mar '24

07 Mar '24

Hi all, As part of being a more inclusive community, I started a translation process on the CoC using our GitHub repository[1], and with the LATAM community, we are managing to finish it[2]. However, we would like to get the approval so this can be official. From Allison's comments, I understand that the foundation doesn't have any Spanish-fluent employees. So, my question is: - How can we get this translation validated? - What will you need from us to do, so we can get this translation as official? 1- https://github.com/opensource-latinamerica/openinframx/issues/5 2- https://github.com/opensource-latinamerica/openinframx/blob/5-post-add-open… Cheers! -- Alvaro Soto *Note: My work hours may not be your work hours. Please do not feel the need to respond during a time that is not convenient for you.* ---------------------------------------------------------- Great people talk about ideas, ordinary people talk about things, small people talk... about other people.

1 0

Outreachy applicant Harshita Verma
by 174_Harshita verma 08 Mar '23

08 Mar '23

To post to this mailing list. harshita174btcse21(a)igdtuw.ac.in

1 0

GPLv3 and Apache2 licences for Openstack repos
by Sergey Sh 09 Dec '19

09 Dec '19

Hi, all I wonder if I can get help here or suggestions for licenses question. We move Ansible modules from upstream Ansible repository to Openstack namespace. In parallel, we need to develop new modules and modules that will replace those moved from Ansible. Moved original modules won't change. The problem is that Ansible and its modules have GPLv3 license and repositories of Openstack have Apache2. There are about 150+ people committed to Ansible modules for years, so it's hardly possible to get approval for relicensing from everyone. How can we handle this situation without violating licenses and agreements? As I see it's 3 options 1. Move GPL modules to SIG repo in Openstack, freeze them there, and create a new Openstack repo with Apache2 license and develop the new modules in it. Won't it be a problem if new modules will have the same functionality as GPL ones? 2. Move GPL modules to SIG repo in Openstack, to develop new modules in GPL there. 3. Move GPL modules to SIG repo in Openstack, to develop new modules in Apache2 there. I think because of partial incompatibility of Apache2 <-> GPLv3 licenses option 3 is barely viable [1] Option 2 is less preferred because it puts module aside from all Openstack projects that have Apache2 license. What are the potential issues of option 1? I'd appreciate any ideas or opinions about the topic. Thanks [1] https://www.apache.org/licenses/GPL-compatibility.html *Apache 2 software can therefore be included in GPLv3 projects, because the GPLv3 license accepts our software into GPLv3 works. However, GPLv3 software cannot be included in Apache projects. The licenses are incompatible in one direction only, and it is a result of ASF's licensing philosophy and the GPLv3 authors' interpretation of copyright law.* -- Best regards Sagi Shnaidman

3 2

Seeking approval for inclusion of Scapy in global-requirements
by Nate Johnston 24 Jul '19

24 Jul '19

OpenStack legal-discuss, Hello, my name is Nate Johnston and I work primarily on OpenStack neutron. I am currently working on a new feature to permit or restrict traffic based on ethertype. This is a change that has security implications, because it allows us to restrict certain types of network traffic that we have ignored until now - specifically ethertypes other than IPv4, IPv6 and ARP within an L2 broadcast domain. In order to properly test this functionality I needed to create packets with custom ethertypes and test their arrival or non-arrival. The best tool for this is the 'scapy' library, which is licensed GPL v2. This would be a testing-only usage, and would not be used at runtime, so per the Licensing Requirements page I am seeking approval from you. The requirements change where I have requested this is [1]; the homepage for the Scapy project is [2]. Thanks, Nate Johnston [1] https://review.opendev.org/#/c/671776/ [2] https://scapy.net/

2 1