<commit_before>---
date: 2020-03-10 11:39:00+02:00
menu:
  main:
    identifier: technical-saml2-coco
    parent: technical-saml2
slug: coco
linkTitle: Code of Conduct (CoCo)
title: GÉANT Code of Conduct (CoCo) for SAFIRE providers
url: /technical/saml2/coco/
---

The [GÉANT Code of Conduct for Service Providers](https://wiki.refeds.org/display/CODE/Code+of+Conduct+for+Service+Providers) (CoCo) provides an approach for service providers who need to meet the European Union's data protection directive and/or the general data protection regulations. It may be required by SAFIRE service providers that provide services to European entities.

### Attesting CoCo compliance

If you need to attest to your service provider's CoCo compliance, in addition to a [registration request]({{< ref "/technical/saml2/forms.md" >}}) you also need to supply a statement of your CoCo compliance. You should be aware that, unlike [Sirtfi]({{< relref "../sirtfi/_index.md" >}}), CoCo introduces binding obligations on the organisation attesting compliance and operating the service provider.

You can use the following template:

  * [SAFIRE CoCo Compliance Template](./SAFIRE-CoCo-Compliance-Template.docx)

This statement must be on institional letterhead, and should be signed by your institution's Information Officer (as defined in the Protection of Personal Information Act) or other executive officer.

#### Privacy Statement updates

In order to attest to CoCo compliance, you may need to update your service's privacy statement. In particular, your Privacy Statement MUST:

 * include the name, address and jurisdiction of the Service Provider. Ideally contact details for your Information Officer should be provided.
 * indicate a commitment to the Code of Conduct. The Privacy Statement should therefore include text about the Code and should link to the Code URL.

#### Attribute updates

You must review the attributes your service requires, and update your metadata to include `md:RequestedAttribute` elements to indicate all the attributes that the Service Provider will request. The `isRequired` flag MUST be used to indicate which attributes are required for the service to function and which are optional.

### CoCo-compliant entities

The following entities in SAFIRE have already attested their CoCo compliance and have this asserted in metadata:

{{< participantlist type="coco" >}}

<commit_msg>Minor cosmetic changes; reinforce service providers<commit_after>---
date: 2020-03-10 11:43:00+02:00
menu:
  main:
    identifier: technical-saml2-coco
    parent: technical-saml2
slug: coco
linkTitle: Code of Conduct (CoCo)
title: GÉANT Code of Conduct (CoCo) for SAFIRE service providers
url: /technical/saml2/coco/
---

The [GÉANT Code of Conduct for Service Providers](https://wiki.refeds.org/display/CODE/Code+of+Conduct+for+Service+Providers) (CoCo) provides an approach for service providers who need to meet the European Union's data protection directive and/or the general data protection regulations. It may be required by SAFIRE service providers that provide services to European entities.

### Attesting CoCo compliance

If you need to attest to your service provider's CoCo compliance, in addition to a [registration request]({{< ref "/technical/saml2/forms.md" >}}) you also need to supply a statement of your CoCo compliance. You should be aware that, unlike [Sirtfi]({{< relref "../sirtfi/_index.md" >}}), CoCo introduces binding obligations on the organisation attesting compliance and operating the service provider.

You can use the following template:

  * [SAFIRE CoCo Compliance Template](./SAFIRE-CoCo-Compliance-Template.docx)

This statement must be on institional letterhead, and should be signed by your institution's Information Officer (as defined in the Protection of Personal Information Act) or other executive officer.

#### Privacy Statement updates

In order to attest to CoCo compliance, you may need to update your service's Privacy Statement. In particular, your Privacy Statement MUST:

 * include the name, address and jurisdiction of the Service Provider. Ideally contact details for your Information Officer should be provided.
 * indicate a commitment to the Code of Conduct. The Privacy Statement should therefore include text about the Code and should link to the Code URL.

#### Attribute updates

You must review the attributes your Service Provider requires, and update your metadata to include `md:RequestedAttribute` elements to indicate all the attributes that the Service Provider will request. The `isRequired` flag MUST be used to indicate which attributes are required for the service to function and which are optional.

You should request any changes to your attributes prior to attesting to compliance.

### CoCo-compliant entities

The following entities in SAFIRE have already attested their CoCo compliance and have this asserted in metadata:

{{< participantlist type="coco" >}}


{'fraction_non_alphanumeric': 0.0646987464617873, 'fraction_numerical': 0.008896077638495753, 'mean_word_length': 4.996363636363636, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2749914', 'n_tokens_mistral': 1274, 'n_tokens_neox': 1189, 'n_words': 638}