[VS-NfD] Write the §52 VSA delimitation statement #226

New Issue

fable-5 · 2026-07-30T01:43:55+02:00

fable-5 commented

2026-07-30 01:43:55 +02:00

Plan reference: 20-massnahmenplan.md -> Phase 5
ADR: ADR 0019
Effort: L (3 AT)
Depends on: —

Context

The most important single document of the whole undertaking: it states
which security base functions Dorfteich does not provide and to whom
they fall. It is what keeps the application outside the certification
obligation under §51 VSA, and it does not depend on any implementation —
so it starts first.

Current state

ADR 0019 (this entwurf) is its draft; existing material to draw on:
docs/architecture/security.md, permissions.md, ADR 0007
(auth/sessions), ADR 0015 (backup), ADR 0008 (plugin sandbox).

Acceptance criteria

Each base function (encryption, media protection, network
termination, authentication, and integrity as far as it applies) is
listed with: what the application does, what it deliberately does
not, and which party provides it.
Every claim is traceable to code or configuration — no aspirational
statements.
The deliberate non-features are argued as architecture, not
omission (the plan's explicit instruction: "no encryption in the code
is correct architecture, not a missing feature").
Delta list: where the current state does not yet match the statement,
it points at the issue that closes the gap.
Endpoint-side content copies are named as an operator duty: every
opened page is mirrored into the browser's IndexedDB
(apps/web/src/editor/use-collab-provider.ts:76, database
dorfteich-page-<pageId>), cleared on leave once synced but
deliberately kept for unsynced offline edits.
Confidentiality of that copy is endpoint media protection, i.e. the
platform's function — but it must be stated, not omitted
(10-ist-aufnahme.md -> I-25).
Reviewed against ADR 0019 for consistency; divergences resolve in
the ADR, not in the statement.

Out of scope

Legal review by counsel, and the IT-Grundschutz mapping (#230).

**Plan reference:** `20-massnahmenplan.md` -> Phase 5 **ADR:** ADR 0019 **Effort:** L (3 AT) **Depends on:** — ## Context The most important single document of the whole undertaking: it states which security base functions Dorfteich does **not** provide and to whom they fall. It is what keeps the application outside the certification obligation under §51 VSA, and it does not depend on any implementation — so it starts first. ## Current state - ADR 0019 (this entwurf) is its draft; existing material to draw on: `docs/architecture/security.md`, `permissions.md`, ADR 0007 (auth/sessions), ADR 0015 (backup), ADR 0008 (plugin sandbox). ## Acceptance criteria - [ ] Each base function (encryption, media protection, network termination, authentication, and integrity as far as it applies) is listed with: what the application does, what it deliberately does not, and which party provides it. - [ ] Every claim is traceable to code or configuration — no aspirational statements. - [ ] The deliberate non-features are argued as *architecture*, not omission (the plan's explicit instruction: "no encryption in the code is correct architecture, not a missing feature"). - [ ] Delta list: where the current state does not yet match the statement, it points at the issue that closes the gap. - [ ] **Endpoint-side content copies are named as an operator duty**: every opened page is mirrored into the browser's IndexedDB (`apps/web/src/editor/use-collab-provider.ts:76`, database `dorfteich-page-<pageId>`), cleared on leave once synced but deliberately kept for unsynced offline edits. Confidentiality of that copy is endpoint media protection, i.e. the platform's function — but it must be stated, not omitted (`10-ist-aufnahme.md` -> I-25). - [ ] Reviewed against ADR 0019 for consistency; divergences resolve in the ADR, not in the statement. ## Out of scope Legal review by counsel, and the IT-Grundschutz mapping (#230).

fable-5 added this to the M30 — VS-NfD: compliance documentation milestone 2026-07-30 01:43:55 +02:00

fable-5 added the

effort:L

area:docs

vs-nfd

labels 2026-07-30 01:43:55 +02:00

fable-5 referenced this issue

2026-07-30 01:43:56 +02:00

[VS-NfD] Write the hardening guide with a "VS-NfD operation" reference configuration #227

fable-5 referenced this issue

2026-07-30 01:43:58 +02:00

[VS-NfD] Produce the IT-Grundschutz mapping for APP.3.1 and CON.11.1 #230