Owner of the digital solution

Open Source Matters, Inc

Type

NGO/ Non Profit

Open alternatives

There are no mandatory closed components to operate Joomla. The following optional integrations are not required and can be disabled or replaced: 1. Google reCAPTCHA Service - implemented as a captcha plugin that can be enabled for forms (contact, registration, etc.) 2. Yubico Validation Service - multi-factor authentication plugin only used if administrators enable YubiKey MFA. 3. FIDO Alliance Metadata Service - only used for WebAuthn attestation validation, can be disabled, allowing WebAuthn to work without MDS.

Collects or uses non-PII data and/or content

Yes

Mechanism for extracting or importing non-PII data

Privacy and Law Compliance

Best practices

Accessibility Testing/ Compliance, Automated Testing, Change Management using Version Control, Tagged Releases and Release Notes, Security Best Practices, Open Standards and File Formats

Open standards

Content

Content is collected stored and distributed.

Types of content

Mechanisms to handle inappropriate and illegal content

(1) Policies for identifying inappropriate & illegal content Scope: Joomla is software that others deploy. The project does not host or moderate third party sites. For Joomla-operated properties (e.g., the joomla.org network), community behavior is governed by our Code of Conduct, with an established policy for reporting and handling breaches. Illegal content (including Child Sexual Abuse Material, CSAM) is prohibited and reports are escalated per law. (https://developer.joomla.org/component/content/article/54-about.html, and https://www.opensourcematters.org/images/policies/Policy_regarding_CoC_Breaches.pdf) CSAM & serious harms: We follow established hotlines and legal processes. Where legally required (e.g., in the U.S.), reports go to NCMEC’s CyberTipline; in other jurisdictions, we direct reporters to their national hotline via the INHOPE network. These resources are referenced in our internal procedures and guidance to site operators. (https://www.missingkids.org/gethelpnow/cybertipline, and https://www.inhope.org/ ) Site owner guidance: Because most Joomla deployments are run by independent organizations, we provide features and documentation to help them implement: Terms & Conditions, privacy/consent collection, reporting channels, and moderation workflows (see Features below). (https://docs-next.joomla.org/docs/privacy/privacy-setup/) (2) Mechanisms/features for detecting, moderating, reporting, and removing content Prevention & intake controls Access Control (ACL) & Permissions: granular control over who can create, edit, publish, or delete content/media. Limits who can post in the first place. (https://docs-next.joomla.org/help/users/users-new-or-edit-group/) Publishing Workflows: multi step approvals before content can go live (e.g., Author → Review → Publish). (https://docs-next.joomla.org/docs/workflows/workflow/ ) CAPTCHA: site admins can require CAPTCHA (e.g., reCAPTCHA) on registration and contact forms to reduce spam and abuse submissions. (https://docs-next.joomla.org/help/site/site-global-configuration/) Text/HTML Filters: per-group filtering of disallowed tags/attributes in submitted text to block risky markup. (https://docs-next.joomla.org/docs/configuration/global-configuration/, and https://jdocmanual.org/jdocmanual?article=user%2Feditors%2Fhtml-filters) Media Upload Rules: admin-defined legal extensions, MIME types, and size limits; MIME checking; upload disabled for disallowed types. (https://docs-next.joomla.org/help/media/media-options/) Terms & Privacy Consent: core plugins require consent to a site’s Terms & Conditions and Privacy Policy at registration/login. (https://docs-next.joomla.org/docs/privacy/privacy-setup/) Moderation & enforcement Unpublish / Trash / Delete: moderators can quickly remove or hide offending content using standard article/media states and category controls. (See Articles/Media help and Version History below.) (https://docs-next.joomla.org/help/articles/articles-edit/) Content Version History: full versioning makes it easy to revert changes and preserve evidence when needed. (https://docs-next.joomla.org/help/components/components-version-history/) User Actions Log (audit trail): records administrator/site actions; optional IP logging is available. Useful for incident response and, where appropriate, for law enforcement referrals. (https://docs-next.joomla.org/docs/users/user-actions-log/) Block / disable accounts: admins can immediately block abusive users; mass block/unblock actions are supported. (https://docs-next.joomla.org/docs/users/user-registration/) Reporting channels: site owners can add “Report abuse” links that open a CAPTCHA-protected Contact form, routed to moderators/security. (https://docs-next.joomla.org/help/contacts/contacts-new-or-edit/) Detection & extension ecosystem: Joomla core does not ship automated CSAM or toxic content classifiers. Site owners who need automated detection can integrate third-party moderation services (e.g., image/video moderation APIs) or install vetted anti-spam / abuse prevention extensions from the Joomla Extensions Directory. (JED categories include “Spam Protection” and “Site Security”.) (https://docs.aws.amazon.com/rekognition/latest/dg/moderation.html, https://extensions.joomla.org/tags/spam-protection/) Privacy tooling (for compliant takedowns and user requests) The Privacy Tools and Consent plugins support user data exports/deletions and consent management — helpful when removing illegal content that also contains personal data. (https://docs-next.joomla.org/docs/privacy/privacy-setup/) Security governance (project level) The Joomla Security Strike Team (JSST) addresses core CMS security issues and processes reports affecting .joomla.org sites; extension security issues are handled via the Vulnerable Extensions process. (Not content moderation per se, but part of abuse mitigation and safe operations.) (https://developer.joomla.org/security.html, and https://extensions.joomla.org/vulnerable-extensions/submit-a-report/) Our end-to-end process (summary) 1. Intake & triage: Content arrives via controlled roles/workflows; suspect items can be held for review. (https://docs-next.joomla.org/docs/workflows/workflow/) 2. Moderation: Moderators unpublish/delete content and block users; actions are logged. (https://docs-next.joomla.org/docs/users/user-registration/) 3. Reporting: For content that is illegal (e.g., CSAM), site operators are instructed to file to the appropriate hotline (e.g., NCMEC CyberTipline in the U.S. or local INHOPE hotline internationally) and to cooperate with law enforcement. (https://www.missingkids.org/gethelpnow/cybertipline, https://www.inhope.org/) 4. Remediation & follow up: Use Version History and Action Logs to preserve necessary records, fulfil data requests via the Privacy tools, and tighten ACL/filters as needed. (https://docs-next.joomla.org/help/components/components-version-history/) Important honesty notes: Joomla does not proactively scan third-party sites for illegal content and does not include built-in CSAM detectors. It does provide governance tooling (ACL, workflows, logging, consent, filters) and an extension ecosystem so operators can meet their legal duties. (https://docs-next.joomla.org/docs/workflows/workflow/) On Joomla-operated websites, illegal content is prohibited under our Code of Conduct and handled under the documented breach policy. (https://www.opensourcematters.org/images/policies/Policy_regarding_CoC_Breaches.pdf)

Allows user interaction

Yes

Mechanisms to protect users and contributors

The Joomla Project enforces a public Code of Conduct across official spaces, with an ombudsman structure for appeals and a formal CoC breach process. Joomla: https://docs.joomla.org/Joomla:Code_of_Conduct_(COC). Joomla Community Magazine™: https://magazine.joomla.org/all-issues/january-2021/how-to-keep-the-fun-in-working-together Joomla! Volunteers Portal™: https://volunteers.joomla.org/groups Open Source Matters: https://www.opensourcematters.org/images/policies/Policy_regarding_CoC_Breaches.pdf Community moderation actions (warnings, suspensions, bans) are documented and reviewable. Users and contributors can easily and confidentially report incidents through the dedicated email address: conflict@joomla.org or fill out the following incident report form: https://docs.google.com/forms/d/e/1FAIpQLSea_VL9NUvUM3iX-gptNuJe5oz5-jp9y5Y4v9ZyKImblfYTcQ/viewform The Conflict Resolution Team (CRT) reviews these reports and responds appropriately. The CRT serves as a neutral, confidential point of contact that receives, assesses, and mediates complaints about harassment or violations of the Code of Conduct in a fair manner. The goal of the CRT is to maintain peace and safety within the community so that all contributors feel comfortable and can collaborate productively. The fastest and easiest way to reach the Conflict Resolution Team (CRT) is by email at: conflict@joomla.org. CRT Webpage: https://volunteers.joomla.org/teams/conflict-resolution-team Safety and Security of Underaged Users: It is stated in the Joomla Privacy Policy that official Joomla websites do not knowingly collect personal information from children under the age of 16, complying with regulations like COPPA and GDPR. Evidence Joomla: https://www.joomla.org/privacy-policy.html (Section: Children's Privacy). Product features that help users protect themselves ACL lets site owners limit who can message, comment, or publish. https://docs-next.joomla.org/docs/articles-access/restricting-access-to-an-article/ Joomla! Documentation: https://jdocmanual.org/jdocmanual?article=developer%2Fsecurity%2Fhttp-header-management MFA for accounts, force HTTPS, and security headers reduce account takeovers and spoofing used for harassment. Joomla! Issue Tracker: https://issues.joomla.org/tracker/joomla-cms/37686 Joomla! Documentation: https://docs-next.joomla.org/docs/security/enabling-https-on-your-site Jdocmanual: https://jdocmanual.org/jdocmanual?article=developer%2Fsecurity%2Fhttp-header-management Workflows and unpublish controls allow rapid removal or prevention of abusive content. Joomla! Documentation: https://docs-next.joomla.org/docs/workflows/workflow/