RMA · TRUST & ACCOUNTABILITY
Security and research data handling
Agree the data boundary before the first transfer.
Revised 15 October 2026 · Research Metrics Africa
Public enquiry versus private project
Do not paste participant names, identifiers, health records, credentials or connector tokens into a public form. Describe the objective, format and sensitivity. Agree the permitted fields and secure transfer route before uploading.
Access and project boundaries
RMA uses personal accounts, organisation membership and assigned project permissions. Authentication and server-side authorisation protect private work; search-engine exclusion is an additional boundary, not access control. Request an access review when responsibilities change.
Retention, export and deletion
Confirm dataset retention and export needs at intake. Retention depends on the selected service and project settings; do not assume indefinite archival. Ask the project owner about deletion/export through the authenticated project conversation. Backups, legal constraints and agreed recordkeeping may affect timing.
Security fit and limitations
No ISO, GCP, 21 CFR or blanket GDPR compliance certification is claimed. If residency, a specialist regulated workflow, contractual audit rights or a particular recovery objective is mandatory, state it before transfer. A fit review must establish whether the current deployment can meet it.
Report a concern
Report a suspected exposure privately through the contact route; provide only a minimal description and affected route. Do not send access tokens or exposed participant information. For an active project, contact its assigned lead through the authenticated conversation.