Update Security Statement to mention ToU interventions

[yaelberger-commits]

Update Security Statement to mention ToU interventions

• [ ] Yedida to draft new content in EN
• [ ] Yael and Melissa to review content
• [ ] Marie Sophie to translate content
• [ ] Yael to update GC Articles pages in EN and FR
• [ ] Yael to clear cache
• [ ] QA in production that changes are accurate

[YedidaZalik]

There are several new TOU interventions we could reference in the Security statement. @mtoutloff should we reference all or just some of these:

• Prompting users to read through TOU on sign up and accept summary terms each time they sign in
• Added: Misuse includes creating duplicate services or services incompatible with your original purpose.
• Added:Create your GC Notify account with a work email address only you can access. Do not share inboxes, account information or passwords, even among staff.
• Added: Secure your API keys and follow our rules for API calls and unprocessed requests as well as callbacks. If you cannot meet our callback requirements, we’ll need to suspend callbacks for your service

(Also notice typo in TOU, under "Accept risks when sending text messages" in second bullet "ofinformation" needs a space

[YedidaZalik]

@mtoutloff recommends waiting for Yael's return to work on this card and I agree. From Melissa: I had a look at the Security statement this morning and I am still not clear on what was meant by "update security statement to mention TOU interventions". As we discussed yesterday, it's not clear if it means adding a statement that users are required to accept the TOU requirements upon login or to list the TOU interventions from the login screen in the Security statement. My thinking is it's likely some type of statement regarding the former (that users are required to accept the TOU), here's why: While the Security statement is a mix of both our responsibilities and our user's responsibilities (as well as suggestions to users to enhance security on their end), I would be reluctant to repeat what's already in the TOU, mostly because I think it might be impractical. Every time we update the TOU, we'd have to also review the Security statement to check if it also needs updates. And I'm not sure from a content perspective if it makes sense to have the same information appear in two different policy statements. This also made me think whether we might want to consider moving some of the user responsibility content in the Security statement (under the headers "If you suspect a security breach or discover a vulnerability" and "You have security responsibilities") to the TOU. I think it's more helpful for our users to have a clear delineation in our policy statements of what's their responsibility and what's ours and for them to all be in one place.

From me: If we move content to the TOU, we should try hard not to add any new headings, It's our use of the headings that still keeps it scannable and allows for the shortened version on log in.