Security and Safety
Security protects the data. Safety protects the people.
The people who give memory to this archive may face real danger. No record, photograph or name is worth a life.
Protecting the data
| Measure | What it means |
|---|---|
| Protected keys | Database keys and passwords are never shared, never placed in website files and never sent by email |
| Access enforced by the database | The database itself decides who can see each record, not just the website |
| Two-step sign-in | Required for Administrators, Guardians and Reviewers |
| Least access | Everyone has only the access their role needs |
| Backups | Regular copies kept offline in at least two separate places, and tested by restoring them |
| Encrypted connections | HTTPS on every page |
| Payments | Handled by the payment provider. No card details are stored on this site |
| Uploads | Hidden location data is removed from photographs before they are stored |
| Forms | Spam and abuse protection on every form |
| Audit log | Every change, approval and removal is recorded, with who made it and when |
| Software updates | Software is kept on fixed, current versions and reviewed regularly |
Protecting people
- Names withheld by default. Anyone living in Papua, whether a researcher, Guardian or contributor, is not named unless they agree in writing.
- No public names of living people connected to resistance activity.
- Location precision. Public maps never show homes, sacred sites or exact places linked to living people. Public locations are rounded to district level.
- Secure communication. Researchers use end-to-end encrypted messaging. Sensitive material is never sent by ordinary email or SMS.
- Safe recording. Researchers stop if a recording puts anyone at risk. Devices are locked and encrypted.
- Children. No images or names of children without a parent’s or guardian’s consent, and never in public view.
- Care for researchers. Support for those recording deaths, violence and grief.
- If a researcher is in danger, their account can be suspended at once and their contributions hidden.
If something goes wrong
- Contain. Suspend affected accounts and hide affected records.
- Assess. Find out what was exposed, and who may be at risk.
- Warn. Contact affected people directly and quickly.
- Fix and record. Close the weakness and log what happened.
- Report. Tell the Council of Guardians and, where the law requires, the relevant authority.
Reporting a security problem
If you find a weakness in this website or the Library, write to security@natakaresearchinstitute.org. Please do not test it in a way that could expose records or people, and do not share the problem publicly until we have fixed it.
Sending us sensitive information
Do not send sacred knowledge, the names of the dead, or anything that could identify a living person in Papua through an ordinary email or a website form. Write first to ask for a secure channel, and we will reply with how to reach us by end-to-end encrypted messaging.