# Security, privacy and compliance

#### TIP
At Weblate, security maintains an environment that values the privacy of our users.

Development of Weblate adheres to the [Best Practices of the Open Source Security Foundation](https://www.bestpractices.dev/en/projects/552).

#### SEE ALSO
Discovered a security issue in Weblate? Please read [Product vulnerability reports](https://docs.weblate.org/no/latest/security/issues.md#security).

## Security updates and releases

Only the latest Weblate release is guaranteed to receive security updates.
Learn more about [Weblate releases and supported versions](https://docs.weblate.org/no/latest/security/releases.md).

Release artifacts can be checked using published signatures, attestations, and
SBOMs. See [Release artifacts and verification](https://docs.weblate.org/no/latest/security/release-artifacts.md).

## Security policies

* [Product and contact information](https://docs.weblate.org/no/latest/security/product-information.md) - product identity, contact, support, release,
  and SBOM metadata.
* [Security governance and assessment status](https://docs.weblate.org/no/latest/security/governance.md) - security governance documentation and assessment status.
* [Releases and supported versions](https://docs.weblate.org/no/latest/security/releases.md) - release cycle, security update coverage, and upgrade
  support.
* [Release artifacts and verification](https://docs.weblate.org/no/latest/security/release-artifacts.md) - release artifact inventory, SBOMs, signatures,
  attestations, and verification.
* [Dependencies](https://docs.weblate.org/no/latest/security/dependencies.md) - dependency inventory, vulnerability triage, update
  automation, and container scanning.
* [Vulnerability and incident handling](https://docs.weblate.org/no/latest/security/issues.md) - vulnerability reporting and disclosure.
* [Incident reporting](https://docs.weblate.org/no/latest/security/incident-reporting.md) - reporting steps and a private incident note template.
* [Disaster recovery plan](https://docs.weblate.org/no/latest/security/disaster-recovery-plan.md)
* [Incident response plan for Weblate](https://docs.weblate.org/no/latest/security/incident-response-plan.md)
* [Password security](https://docs.weblate.org/no/latest/security/passwords.md)
* [Weblate threat model](https://docs.weblate.org/no/latest/security/threat-model.md)

## Compliance

#### NOTE
Herein you will find various legal information you might need to
operate Weblate in certain legal jurisdictions. It is provided as a means of guidance,
without any warranty of accuracy or correctness. It is ultimately your
responsibility to ensure that your use of Weblate complies with all applicable
laws and regulations.

* [Privacy regulations compliance](https://docs.weblate.org/no/latest/security/privacy-compliance.md)
* [Data residency and EU cloud sovereignty](https://docs.weblate.org/no/latest/security/data-residency.md)
* [US controls compliance](https://docs.weblate.org/no/latest/security/us-compliance.md)
* [Weblate license](https://docs.weblate.org/no/latest/contributing/license.md)

## Terms of service and privacy policy

#### NOTE
These documents apply to Weblate deployments operated by Weblate s.r.o.,
such as Hosted Weblate and Weblate Cloud.

* [General terms and conditions](https://weblate.org/terms/)
* [Privacy policy](https://weblate.org/privacy/)
* The data processing agreement can be obtained in the
  [Customer area](https://weblate.org/user/).

## Guidelines

* [Localization Threat Model](https://docs.weblate.org/no/latest/security/localization-threat.md)