Operator Responsibilities and Support
Overview
UnoLock Federated Node is free, open-source software under the GNU AGPL version 3. When you run a node, you are its operator. Independent nodes are operated and maintained by their own operators, not by TechSologic Inc.
An official UnoLock software release does not make an independent node a TechSologic-operated or endorsed service. Using official software, UnoLock branding or federation compatibility does not establish TechSologic sponsorship, endorsement, certification or an agency relationship.
What operators are responsible for
As the operator of a node, you are responsible for your own service, including:
- hosting, installation and configuration;
- host security, including the operating system, firewall and container runtime (see Host Security);
- updates (publishing a software update does not install it on your node; see Upgrading);
- access policies and Safe registration;
- availability;
- backups and recovery (see Backup and Recovery);
- applicable legal obligations.
You also communicate any terms for your hosting service, storage, availability and backups to the people who use your node. Those arrangements do not replace the AGPL software license or transfer software rights.
TechSologic does not undertake to monitor, secure, update, back up, restore, or keep independent nodes available.
What Safe users should know
Safe users on an independent node should identify their node's operator and understand that operator's service terms, privacy practices, backup arrangements and recovery limits. Questions about access or operation go to the node's administrator, not to TechSologic.
Support
TechSologic does not provide technical support for the federated node or its bundled client. There is no technical-support service or service-level agreement.
The documentation is self-service. Bug reports, feature proposals and voluntary community replies do not create a commitment to respond, provide a fix, or help operate a node.
| Need | Where to go |
|---|---|
| Install or operate a node | This Self-Hosted section, starting at the overview |
| Diagnose an operational problem | Troubleshooting |
| Report an ordinary bug or propose a feature | The repository's issue templates |
| Report a vulnerability | Private reporting, as described below |
| Conduct reports or branding-permission enquiries | support@unolock.com (not a technical-support mailbox) |
Never send secrets to anyone offering help
Do not send Safe credentials, recovery material, private keys, complete databases, or unencrypted vulnerability details to the project mailbox or anyone offering assistance.
Writing a useful bug report
Include the version or commit, the image digest when applicable, operating system, browser, deployment mode, a minimal reproduction, and expected versus observed behavior. Say whether the issue also happens in a clean browser profile or a fresh node, if you have tested that safely.
Use synthetic identifiers and a minimal, sanitized configuration excerpt. Do not attach raw HAR files, database backups, bootstrap or registration codes, access proofs, signed URLs, Safe or contact identifiers, private onion identities, or unedited logs. Redaction must cover metadata as well as obvious passwords.
Reporting security issues
Do not open a public issue for an unpatched vulnerability. Use GitHub private vulnerability reporting. If that route is unavailable, follow the fallback contact in SECURITY.md: initially send only the affected version and a request for a private reporting channel, and arrange an encrypted method before sending exploit details or sensitive data.
A report should include:
- the affected version or commit;
- the deployment mode and relevant non-secret configuration;
- the affected trust boundary or invariant;
- minimal reproduction steps;
- observed and expected behavior;
- impact and any known preconditions.
Never include live Safe credentials, registration codes, access proofs, federation tokens, TLS private keys, onion private keys, archive contents, or unencrypted user metadata. Do not test against other people's nodes or Safes without their authorization.
Security fixes target the latest official 2.x release. For older releases, upgrade to the latest release; there is no backport commitment. TechSologic aims to acknowledge a complete report within three business days, provide an initial assessment within seven business days, and send a status update at least every fourteen days while a confirmed issue remains open.
Licensing obligations
The node and its bundled web client, including UnoLock Drop, Safe-App and the service worker, are licensed under the GNU AGPL version 3 (AGPL-3.0-only).
- No trial, purchase, license token, renewal, or paid activation is required.
- You may use, modify and redistribute the software under the AGPL terms.
- Those terms include corresponding-source requirements for covered distribution and for modified versions that you run as a network service.
- Preserve applicable copyright, license and third-party notices.
- Separately licensed dependencies keep their own terms.
- The license covers the federated-node distribution. It does not relicense the managed UnoLock service, its separately supplied client, or other products.
The software is provided "as is" without warranty to the extent permitted by applicable law; sections 15 to 17 of the AGPL set out the disclaimer of warranty and limitation of liability.
See the licensing guide and the LICENSE for the full terms.
Trademarks
TechSologic Inc. retains the UnoLock name, logos and associated trademarks. The AGPL does not grant permission to present a modified build, independent service, or fork as an official TechSologic product.
- Running a node: you may accurately say you run UnoLock software, but must not imply that TechSologic operates or endorses your service.
- Redistributing an unchanged official release: keep its existing notices and branding, and clearly identify yourself as an independent distributor. A mirror is not an official release channel.
- Modified builds and forks: give them their own product name and branding unless TechSologic has granted written permission. You may describe them as "based on UnoLock Federated Node."
- References: you may use the UnoLock name to identify the project, discuss or review it, report research findings, or accurately describe compatibility, as long as you do not imply sponsorship, endorsement or official status.
While TechSologic operates, it controls official UnoLock Federated Node releases. Official release status is not required to operate a node or take part in federation; protocol compatibility and each receiving node's security and resource policies still apply. See TRADEMARKS.md.
Built to outlast any one company
The federation is built to outlast any one company. Operators can build and run the AGPL node independently and configure their own bootstrap peers. Continued operation depends on participating operators and reachable peers, rather than TechSologic remaining in business. This does not automatically recover data from a service that has shut down.
If TechSologic permanently ceases operating, the project's succession policy calls for stewardship and official release responsibility to pass to designated successor maintainers through a documented handover. Acquiring an abandoned domain, repository, or package name does not confer that role. Independent federation operation and AGPL software rights do not depend on that handover.
FAQs
Does TechSologic run or support my node?
No. Independent nodes are operated and maintained by their operators. TechSologic does not provide technical support or a service-level agreement for the federated node.
Where do Safe users on my node go for help?
To you, the node's administrator. Safe users should direct access and operational questions to their node's operator.
How do I report a security vulnerability?
Privately, through GitHub private vulnerability reporting for the repository, or the fallback route in SECURITY.md. Never post an unpatched vulnerability in a public issue.
Do I have to pay to run a node?
No. The software is free under the AGPL with no trial, purchase, license token, renewal or paid activation. You provide your own hosting, domain, storage, backups and administration.
If I modify the node and run it for others, what do I owe?
The AGPL's corresponding-source requirements apply to covered distribution and to modified versions you run as a network service. Give a modified build its own name and branding unless TechSologic has given written permission.
Can I call my node an UnoLock node?
You may accurately say you run UnoLock software. You must not imply that TechSologic operates or endorses your service.
What happens to the federation if TechSologic shuts down?
Operators can keep building and running the AGPL node and configure their own bootstrap peers. The federation depends on participating operators and reachable peers, not on TechSologic remaining in business.