search

filecoin-project / notary-governance

115 stars 58 forks source link

v5 Notary Allocator Application: Herony #1059

Closed herony-fil closed 8 months ago

herony-fil commented 10 months ago

v5 Notary Allocator Application

To apply to be an allocator, organizations will submit one application for each proposed pathway to DataCap. If you will be designing multiple specific pathways, you will need to submit multiple applications.

Please complete the following steps:

1. Fill out the information below and create a new GitHub Issue

  1. Notary Allocator Pathway Name (This can be your name, or the name of your pathway/program. For example "E-Fil+"): Herony
  2. Organization Name: Herony
  3. On-chain address for Allocator (Provide a NEW unique address. During ratification, you will need to initialize this address on-chain): f1i5ghwv6m4wsn5rsqsnjl2rgrgxtbc3osgkddbei
  4. Country of Operation (Where your organization is legally based): Greater China Region (GCR)
  5. Region of Operation (What region will you serve?): All Regions
  6. Type of Allocator, diligence process: (Automated/programmatic, Market-based, or Manual (human-in-the-loop at some phase): Market-based and Manual
  7. DataCap requested for allocator for 12 months of activity (This should be an estimate of overall expected activity. Estimate the total amount of DataCap you will be distributing to clients in 12 months, in TiB or PiB):100PiB

2. Access allocator application (download to save answers)

Click link below to access a Google doc version of the allocator application that can be used to save your answers if you are not prepared to fully submit the application in Step 3. https://docs.google.com/document/d/1-Ze8bo7ZlIJe8qX0YSFNPTka4CMprqoNB1D6V7WJJjo/copy

3. Submit allocation application

Clink link below to access full allocator questionnaire and officially submit your answers: https://airtable.com/appvyE0VHcgpAkt4Z/shrQxaAIsD693e1ns

Note: Sections of your responses WILL BE posted back into the GitHub issue tracking your application. The final section (Additional Disclosures) will NOT be posted to GitHub, and will be maintained by the Filecoin Foundation. Application information for notaries not accepted and ratified in this round will be deleted.

Kevin-FF-USA commented 10 months ago

Hi @herony-fil,

Thanks for submitting to become and Allocator! Wanted to confirm this application has been received along with your completed Airtable form.

ghost commented 10 months ago

Basic Information

1. Notary Allocator Pathway Name: Herony

2. Organization: Herony

3. On Chain Address for Allocator: f1i5ghwv6m4wsn5rsqsnjl2rgrgxtbc3osgkddbei

4. Country of Operation: China

5. Region(s) of operation: Africa , Asia minus GCR, Greater China, Europe, Oceania, Japan, North America, South America

6. Type of Allocator: Market-based

7. DataCap requested for allocator for 12 months of activity: 100PiB

8. Is your allocator providing a unique, new, or diverse pathway to DataCap? How does this allocator differentiate itself from other applicants, new or existing?: Our DataCap Allocation Service provides personalised and innovative support models tailored to each applicant's unique situation and needs. Rather than relying solely on standard assessment processes, we combine automated data analysis with expert review in an advanced risk assessment model. This improves efficiency while enhancing our ability to identify and manage risk. We offer a range of DataCap options to meet the diverse needs of applicants, from small businesses to large organisations. Unlike other allocators, we maintain close contact and provide ongoing guidance and support to ensure resources are used effectively and compliantly. The application and usage process is fully transparent, allowing applicants to track the status of their applications and DataCap usage in real time. This helps to build trust. In summary, our distinctive approach and innovative methods can provide a more equitable, efficient and adaptable DataCap allocation service for all types of applicants.

9. As a member in the Filecoin Community, I acknowledge that I must adhere to the Community Code of Conduct, as well other End User License Agreements for accessing various tools and services, such as GitHub and Slack.: Acknowledge

Client Diligence

10. Who are your target clients?: Small-scale developers or data owners, Individuals learning about Filecoin, Enterprise Data Clients

11. Describe in as much detail as possible how you will perform due diligence on clients. If you are proposing an automated pathway, what diligence mechanism will you use to determine client eligibility?: Customer due diligence is very important. We will conduct due diligence on customers from the following aspects:

  1. Legal compliance: Ensure that customers are legally registered and operating in their jurisdiction. Customers may provide relevant business registration information, business licences, etc.
  2. Business purpose: Require customers to provide detailed information about their business purpose, especially the specific purpose of the data services.
  3. Business finances: Require customers to provide recent financial statements to ensure their financial health
  4. Non-disclosure agreement and data use policy: Clients must sign a non-disclosure agreement to protect their data from misuse
  5. Technical Security: Understand the client's data security measures and ensure that they have appropriate technical measures in place to protect the data provided.

12. Please specify how many questions you’ll ask, and provide a brief overview of the questions.: We have prepared 12 due diligence questions, as follows:

  1. Please provide information such as the company's registered name, legal representative, and registered address
  2. What are the company's establishment date and operating hours?
  3. Is the company legally registered and operating in the region? If so, please provide relevant business registration information or business license
  4. What is the company's main business? Please provide a detailed business model
  5. What data do you plan to store after obtaining the data quota?
  6. What is the Filecoin address you would like me to allocate the DataCap to?
  7. How many DataCap miners do you plan to allocate? If you have specific miners you want to allocate DataCap to, please specify.
  8. Please provide the latest financial statement data
  9. What data security measures has the company adopted?
  10. Is there a dedicated Privacy Policy and Data Use Policy?
  11. Are you willing to sign a Non Disclosure Agreement?

13. Will you use a 3rd-party Know your client (KYC) service?: We will use Trulioo to conduct KYC certification for customers. Trulioo is a company that provides digital identity verification and global KYC solutions. Their services are designed to help businesses verify customer identity, comply with compliance, and reduce fraud risks. Trulioo's GlobalGateway platform covers a global scope, covering multiple countries and regions. Specifically, it supports the following regions:

14. Can any client apply to your pathway, or will you be closed to only your own internal clients? (eg: bizdev or self-referral): Our channel is open for any customer to apply and obtain the corresponding DataCap on a first-come, first-served basis based on the premise that the customer passes KYC.

15. How do you plan to track the rate at which DataCap is being distributed to your clients?: Obtain the frequency of credit requests from customers on GitHub issues through emails or scripts to track the rate at which DataCap is allocated to customers The tool we are currently using has a program on the backend that calls the lotus API. It can check the client's activity of allocations every hour to see how they change. With this data, we can calculate the speed and distribution of DataCap. We will respect the existing bot strategy and use https://github.com/filecoin-project/filplus-ssa-bot to monitor the remaining available quota of clients. Additionally, the distribution of clients can be viewed at https://datacapstats.io/. Only when the remaining available quota falls below 25% will it trigger a request for the next round of quota allocation. We will only consider granting the next batch of data cap quotas to clients when the bot triggers the request.

Data Diligence

16. As an operating entity in the Filecoin Community, you are required to follow all local & regional regulations relating to any data, digital and otherwise. This may include PII and data deletion requirements, as well as the storing, transmit: Acknowledge

17. What type(s) of data would be applicable for your pathway?: Private Non-Profit/Social Impact, Private Commercial/Enterprise, Public Open Commercial/Enterprise, Public Open Dataset (Research/Non-Profit)

18. How will you verify a client’s data ownership? Will you use 3rd-party KYB (know your business) service to verify enterprise clients?: Data ownership verification: Contact the customer and request specific details of the data source. Ask which websites or databases the customer's data comes from. Verify that the source websites provided by the customer are all genuine and legal websites, and whether they are still operating normally. Manually study each source to confirm whether it is a publicly available data source. Inquire about the method of Data Acquisition, whether it was crawled from public pages or obtained through other authorized channels. Customers are required to provide data samples for review, which can be uploaded to a secure folder for viewing. Carefully check whether the fields, formats, labels, and overall quality of the sample data are consistent with the customer's previous description. Where feasible, compare the sample data with the actual values on the original website to verify the authenticity of the records. If there are any data sources, collection processes, or sample aspects that need further explanation, proactively request the customer to provide further explanation. Only when all steps have been satisfactorily answered, will the data source be reviewed and the data review work be considered completed.

Using KYB services: Enterprise Identity Verification: Use tools https://www.tianyancha.com/ to verify the legitimacy of the enterprise, including company registration details, business license, legal representative and other information, to ensure that the data owner is a normal operating company. For non-Chinese mainland customers, use third-party KYB services https://ondato.com/business-onboarding/ to verify

19. How will you ensure the data meets local & regional legal requirements?: Data Localization: 1. Assign a dedicated person to fully understand all data localization regulations and policies in the regions involved in the company's business. 2. Collaborate with third parties to regularly compare legal documents and track changes in local regulations. 3. Hire a localization expert or law firm to consult on key issues and provide the latest policy interpretations. 4. Evaluate with legal counsel whether the company's current data storage and processing procedures comply with local regulations. 5. If there are any discrepancies, work with the legal team to study feasible adjustment plans, conduct threat and risk assessments. 6. According to legal guidance, revise relevant policies and operating procedures, and explain new requirements to employees. 7. Regularly review the localization situation, follow up on policy changes, and make corresponding adjustments in a timely manner. 8. If there are significant changes, a working meeting can be held to comprehensively evaluate the impact and revise compliance measures. 9. Clearly record all adjustment work, file legal opinions, and report to regulatory authorities at any time.

20. What types of data preparation will you support or require?: We support standard data formats such as text, images, videos, compressed files, etc. For files larger than 32G, customers need to perform sharding processing. For massive small files, customers need to package and generate multiple standard 32G Compressed Packets. For customers without technical experience, we can provide technical guidance.

21. What tools or methodology will you use to sample and verify the data aligns with your pathway?:

  1. Regularly retrieve encapsulated customer data through boost, at least once a week, to ensure that the claimed type matches the data preparation. 2. A random sampling program is run in the background, and a certain proportion (such as 5%) of the data is randomly selected from the encapsulated data for download and verification each time 3. If abusive behavior is found, we will stop the next batch of quotas. The unused DC amount will be reduced at the same time.

    Data Distribution

    22. How many replicas will you require to meet programmatic requirements for distribution?: 5+

23. What geographic or regional distribution will you require?: 5 physical locations, at least 3 separate geopolitical zones, no need to exclude

24. How many Storage Provider owner/operators will you require to meet programmatic requirements for distribution?: 3+

25. Do you require equal percentage distribution for your clients to their chosen SPs? Will you require preliminary SP distribution plans from the client before allocating any DataCap?: Yes, we will ask customers to provide allocation plans and publicly describe their plans on Github. At the same time, when applying later, we will verify whether their allocation plans are consistent

26. What tooling will you use to verify client deal-making distribution?: In addition to the existing tools and CID checking robots, we will also use https://retrievalbot-dashboard.vercel.app/ to verify, as well as the browser filscan: https://filscan.io/tipset/dsn/

27. How will clients meet SP distribution requirements?: We require customers to allocate data to SP through online or offline methods.

28. As an allocator, do you support clients that engage in deal-making with SPs utilizing a VPN?: Not supported, we will use an online VPN detection tool to detect: https://www.criminalip.io

DataCap Allocation Strategy

29. Will you use standardized DataCap allocations to clients?: Yes, standardized

30. Allocation Tranche Schedule to clients:: We divide the allocation requirements into 5 categories according to the amount of data from L1 to L5. The larger the amount of data requested by the client, the stricter the requirements. The corresponding allocation plan will also be different. The larger the amount of data requested, the smaller the allocation percentage in the early stage, because the client needs to pass the review of each stage to obtain the subsequent quota. L1:<10TB：

31. Will you use programmatic or software based allocations?: Yes, standardized and software based

32. What tooling will you use to construct messages and send allocations to clients?: Open source tools: Notary registration tool https://filplus.fil.org/#/ ; filplus.storage for initial application reception. Lotus binary publishes datacap. Lassie to verify data content.

33. Describe the process for granting additional DataCap to previously verified clients.: We will initiate subsequent allocation requests based on community criteria, we use https://github.com/filecoin-project/filplus-ssa-bot robots to monitor the remaining quota, and when it falls below 25%, the next round of requests will be triggered

34. Describe in as much detail as possible the tools used for: • client discoverability & applications • due diligence & investigation • bookkeeping • on-chain message construction • client deal-making behavior • tracking overall allocator health • disput: Customer discovery and application: GitHub

All GitHub and blockchain-based browsers will be integrated into our email system to automatically obtain relevant information and respond in a timely manner. Automatically generate relevant reports through on-chain information for quick review.

Tools and Bookkeeping

35. Will you use open-source tooling from the Fil+ team?: Yes, we will make full use of open-source tools from the Fil + team. API integration tool https://documenter.getpostman.com/view/131998/Tzsim4NU#98fe18ca-b15a-4753-986f-91882fd87a12 notary allocation query a. https://datacapstats.io/notaries b. https://filplus.info/ data retrieval rate https://retrievalbot-dashboard.vercel.app/. SP decentralized location query SA Bot. Query SP allocation https://datacapstats.io/clients/X/breakdown . Datacap use record a. https://filecoin.tools/b.https://datacapstats.io/clients And on this basis, we also use Google Spreadsheets to apply for review: 1. We divide distribution requirements into 5 categories based on data volume from L1 to L5. The larger the amount of data a client requests, the more stringent the requirements. We want to check these clients by reputation, data, diversity and decentralization, distribution strategy, track record, etc. 2. We designed a scoring system: https://docs.google.com/spreadsheets/d/1wUL_5fTGF4xMTyyd2IQUFkd0uPc6XhayX598I5iqNZU/edit?usp=sharing 3. We plan to present this form in GitHub, just like the notary's application and the design questions and evidence required based on these forms, for clients to fill out and apply for DataCap. We will also publicly score to determine the number of allocations.

36. Where will you keep your records for bookkeeping? How will you maintain transparency in your allocation decisions?:

  1. We will place the publicly available data (e.g. allocation progress, tracking information) in the public repository of our Github account, which is the planned repository address: https://github.com/herony-fil/ xxx. This will be updated in real time, and the allocation progress and tracking information will be automatically updated to the github repository every 24 hours based on the tools we build (if there are more open source tools updated by the Fil + team in the future, we will give priority to using them) for viewing.

  2. In addition, some due diligence and customer information , such as customer asset size, data composition, etc., we will use Google spreadsheets for retention, so that the Fil + management team can communicate via email to request relevant information to resolve disputes or conduct data audits .

    Risk Mitigation, Auditing, Compliance

    37. Describe your proposed compliance check mechanisms for your own clients.: Regular inspection and tracking is a key step in ensuring data compliance and security. Here are the specific plans we will implement:

  3. Regular inspections and reporting: Establish a regular data review and reporting mechanism to monitor data access, use, and transmission activities. Ensure that regular reviews are consistent with compliance and security standards, and timely detect and correct potential issues.

  4. Track DataCap allocation information: Implement DataCap allocation and monitoring to ensure that customer data usage is within the scope of the contract.

  5. Time metrics: track the time and frequency of customer access to data and understand their usage patterns

  6. Trust assessment: Conduct trust assessment on customers, including their compliance history, business reputation, and cooperation cases. Ensure regular assessment of customer trust and timely adjustment of access permissions or restrictions.

  7. Customer profile: Collect and analyze customer profiles, including geographic location, industry, scale, etc.

38. Describe your process for handling disputes. Highlight response times, transparency, and accountability mechanisms.: It is crucial to ensure a transparent, efficient, and fair mechanism between relevant parties for data storage and retrieval on the Filecoin network when setting up a dispute resolution process. Here are some of our solutions:

  1. Establish a dedicated dispute resolution team: responsible for handling all disputes related to data storage and retrieval.
  2. Set response time: Obtain dispute-related issues through email in a timely manner and intervene in a timely manner.
  3. Transparency: Require relevant parties to provide their own evidence in relevant issues on GitHub.
  4. Accountability mechanism: stop the follow-up quota allocation to the bad customers .

39. Detail how you will announce updates to tooling, pathway guidelines, parameters, and process alterations.: Here are some scenarios in which we are announcing updates to tactical tools and strategic planning rules: 1. Regular notifications and updates: Establish a schedule for regular notifications, such as monthly or quarterly, to update participants on changes to tools and rules. Through regular updates, participants can anticipate and prepare for changes. 2. Use multiple notification channels: Utilize multiple communication channels, including GitHub, Slack, email, internal website, etc., to ensure that messages are widely disseminated and that all relevant parties can easily obtain updated information. 3. Advance notice and communication: Notify relevant parties in advance before implementing changes so that they have sufficient time to adjust and prepare. Send advance notice to key stakeholders, especially for changes that may directly affect their workflow or operations. 4. Publish an update notice: After each update, publish a formal update notice, including detailed changes, reasons, and expected impacts. 5. Create an update log: Maintain a detailed update log on GitHub , recording the details and time of each change. 6. Provide training and support: If changes involve new tools, channels, or processes, provide training and support to ensure that users can understand and use the new tools and rules correctly. Provide documentation, training courses, or online support to answer any questions users may have. 7. Create feedback channel: Provide users with a feedback channel so that they can share feedback on changes. Collect user feedback to understand the impact of changes and possible improvement points

40. How long will you allow the community to provide feedback before implementing changes?: Determining when the community will provide feedback takes into account the nature, scale, and impact of the change on community members. We develop a reasonable time frame based on the importance and scale of the change:

  1. Importance of the change: If the change has a significant impact on community members, such as involving improvements in data privacy, security, or user experience, it may take longer (one month) to collect feedback. If the importance is low, it can be reduced to one week to collect feedback.
  2. The scale of the change: The resulting changes are minor changes, and the community may only need a short time (one week) to adapt and provide feedback. For larger changes, such as major modifications to the system architecture, more time (starting from one month) may be needed to evaluate and understand.

41. Regarding security, how will you structure and secure the on-chain notary address? If you will utilize a multisig, how will it be structured? Who will have administrative & signatory rights?: We will use a multi-signature approach to build and protect on-chain notarized addresses to ensure security. Here are the specific solutions:

  1. Multi-signature construction: Use a multi-signature contract to build a multi-signature address, ensuring that at least three or more signatures are required to perform the operation. Determine the signature threshold of the multi-signature contract, which is the minimum number of signatures required (three).
  2. Signature permission management: Define the managers of multi-signature addresses, who are responsible for managing signature permissions. Determine the personnel with signature permissions and their signature weights.
  3. Decentralized storage: Store the private keys of multi-signature contracts in different geographical locations or hardware devices to reduce the risk of single points of failure and attacks. Avoid storing all private keys in the same place.
  4. Regular rotation: Regularly rotate the private keys of multi-signature contracts to prevent the risk of long-term exposure and abuse.
  5. Audit and Monitoring: Regularly audit the signature permission configuration of multi-signature contracts to ensure compliance with security standards. Set up monitoring and alerts to detect and respond to any unauthorized changes or activities in a timely manner.

42. Will you deploy smart contracts for program or policy procedures? If so, how will you track and fund them?: N/A

Monetization

43. Outline your monetization models for the services you provide as a notary allocator pathway.: KYC: 10Fil/time

Data sampling: 0.1 Fil/T

Credit limit approval: 100Fil/time

Regular audits: 0.1 Fil/T

44. Describe your organization's structure, such as the legal entity and other business & market ventures.: Organization：Herony; Network Official Website: http://www.herony.com.cn/ ; Twitter/X: https://x.com/FIL_herony .We have our own IDC (Internet Data Center) and have accumulated a lot of customer resources by providing services to various industries. Our customers are located in Mainland China, Hong Kong, Singapore, Malaysia and other regions. As an early participant of Filecoin, we build our own miner and provide storage service (on Filecoin network) for our customers;We are establishing ourselves as a one-stop integrated service provider. We provide a wide range of value-added solutions to meet the diverse needs of leading domestic companies in various industries and sectors. In addition, as a builder of the Filecoin network, we actively participate in technical discussions and help strengthen the security and governance of the network through our participation in the Filecoin Improvement Proposals (FIPs) process.

45. Where will accounting for fees be maintained?: Accounting fees will be stored on the chain, and we can provide relevant on-chain addresses for third-party queries. We will invite a professional audit team in our company to account for the costs. We will put all records on our website and regularly publish the audits. The process is: Our professional audit team will review the transaction details, flow of funds on a quarterly basis and form an audit opinion, generate a report and finally publish it on our website. Provide a clear audit path for Fil+ governance and stakeholders, and give transparency and ease of audit for all monetisation processes.

Past Experience, Affiliations, Reputation

46. If you've received DataCap allocation privileges before, please link to prior notary applications.: N/A

47. How are you connected to the Filecoin ecosystem? Describe your (or your organization's) Filecoin relationships, investments, or ownership.: SP, ecological builder, firm holder, active in filecoin communities such as github and slack

48. How are you estimating your client demand and pathway usage? Do you have existing clients and an onboarding funnel?: Based on the business size and company size of the client company, investigate its approximate data demand. We have many enterprise customer resources from different industries

galen-mcandrew commented 8 months ago

Datacap Request for Allocator

Address

f2k6v3ojauf7oeghthmucwn7podfr4xslymtkl5mq

Datacap Allocated

5PiB

filplus-bot commented 8 months ago

The request has been signed by a new Root Key Holder

Message sent to Filecoin Network

bafy2bzaceddfslnuza2rbnkhzsae3ldkfaspmut5bpa7hm3euya7yisfhfyhe

You can check the status of the message here: https://filfox.info/en/message/bafy2bzaceddfslnuza2rbnkhzsae3ldkfaspmut5bpa7hm3euya7yisfhfyhe