Add DPG: Somleng

[nathanbaleeta]

Encode Somleng submission into JSON and add it to unicef/publicgoods-candidates/screening.

[nathanbaleeta]

Somleng needs to clarify the following indicators before we can proceed with the review:

• Clear Ownership
• Platform Independence
• Documentation
• Mechanism for Extracting Data and Content
• Adherence to Privacy and Applicable Laws
• Adherence to Standards & Best Practices
• Do No Harm By Design
• Data Privacy & Security
• Inappropriate & Illegal Content.
• Protection from harassment.

@lacabra I will contact the person who made the submission and will update once they come through.

[dwilkie]

Adherence to Privacy and applicable laws.

Has this project taken steps to ensure adherence with relevant privacy, domestic, and international laws? For example, the General Data Protection Regulation (GDPR) in the European Union or the Supplementary Act A/SA.1/01/10 on Personal Data Protection for the Economic Community of West African States (ECOWAS) (yes/no)

Yes

If yes, please list some of relevant laws that the project complies with:

To the best of our knowledge, Somleng does not store any PII for the beneficiaries. The only potential PII that we collect and store is the beneficiary phone number. As such, as an open source project, we do not think GDPR applies to Somleng.

If yes, please describe the steps this project has taken to ensure adherence (include links to terms of service, privacy policy, or other relevant documentation):

• https://github.com/somleng/somleng-project/blob/master/Privacy.md
• NGOs might decide to collect PII information for their specific use-case. We strongly recommend that NGOs do not collect this information if not required.

Adherence to Standards & Best Practices

We follow the following standards:

• JSONAPI
  • Evidence of usage: https://www.somleng.org/docs/carrier_api/#create-an-account
• JWT (RFC 7519)
  • Evidence of usage: https://www.somleng.org/docs/carrier_api/#webhooks
• TLS 1.3 (RFC 8446)
  • Evidence of usage: https://www.ssllabs.com/ssltest/analyze.html?d=somleng.org&s=13.35.122.35&latest
• TOTP (RFC6238)
  • Evidence of usage: https://github.com/somleng/somleng/blob/develop/spec/system/dashboard/authentication_spec.rb#L4

Do No Harm By Design

On the whole, does this project take steps to ensure that it anticipates, prevents and does no harm by design?

Yes

Is there any additional information you would like to share about the mechanisms, processes or policies that this project uses to avoid doing harm by design?

Somleng recommends the cloud hosting option, this is the most cost effective, reliable, and secure option. While using the cloud hosting option users are protected by our privacy policy.

[nathanbaleeta]

Adherence to Privacy and applicable laws.

Has this project taken steps to ensure adherence with relevant privacy, domestic, and international laws? For example, the General Data Protection Regulation (GDPR) in the European Union or the Supplementary Act A/SA.1/01/10 on Personal Data Protection for the Economic Community of West African States (ECOWAS) (yes/no)

Yes

If yes, please list some of relevant laws that the project complies with:

To the best of our knowledge, Somleng does not store any PII for the beneficiaries. The only potential PII that we collect and store is the beneficiary phone number. As such, as an open source project, we do not think GDPR applies to Somleng.

If yes, please describe the steps this project has taken to ensure adherence (include links to terms of service, privacy policy, or other relevant documentation):

• https://github.com/somleng/somleng-project/blob/master/Privacy.md
• NGOs might decide to collect PII information for their specific use-case. We strongly recommend that NGOs do not collect this information if not required.

Adherence to Standards & Best Practices

We follow the following standards:

• JSONAPI

  • Evidence of usage: https://www.somleng.org/docs/carrier_api/#create-an-account

• JWT (RFC 7519)

  • Evidence of usage: https://www.somleng.org/docs/carrier_api/#webhooks

• TLS 1.3 (RFC 8446)

  • Evidence of usage: https://www.ssllabs.com/ssltest/analyze.html?d=somleng.org&s=13.35.122.35&latest

• TOTP (RFC6238)

  • Evidence of usage: https://github.com/somleng/somleng/blob/develop/spec/system/dashboard/authentication_spec.rb#L4

Do No Harm By Design

On the whole, does this project take steps to ensure that it anticipates, prevents and does no harm by design?

Yes

Is there any additional information you would like to share about the mechanisms, processes or policies that this project uses to avoid doing harm by design?

Somleng recommends the cloud hosting option, this is the most cost effective, reliable, and secure option. While using the cloud hosting option users are protected by our privacy policy.

Thanks @dwilkie for the responses, could you also kindly mention some of the best pracitces Somleng used in the design and implementation of the digital solution. (Hint: Principles of digital development, see more)

Cc: @ngcheryl

[dwilkie]

Hi @nathanbaleeta sorry I missed your reply

Here's the missing information.

Adherence to Standards & Best Practices

Reuse and Improve

Somleng contains a compatible open source implementation of Twilio's REST API. This API has become the the de-facto standard for Cloud Communications. By being compatible with this API, users of Twilio an easily migrate to Somleng by just updating the endpoint URL in the open source libraries.

Somleng also contains an open source TwiML parser. TwiML is the de-facto markup language for controlling calls and SMS. By providing an open source TwiML parser the community can suggest or contribute support for more features and Verbs.

Use Open Standards, Open Data, Open Source, and Open Innovation

JSON:API Standard

Somleng's Carrier API is written according to the JSONAPI standard.

From the JSON:API standard.

By following shared conventions, you can increase productivity, take advantage of generalized tooling, and focus on what matters: your application.

Clients built around JSON:API are able to take advantage of its features around efficiently caching responses, sometimes eliminating network requests entirely.

By using the JSON:API standard consumers of the API can use a pre-built client which avoids the need for us to provide helper libraries for various programming languages. In addition it serves as a set of conventions for us to follow, eliminating the need for us to make some decisions on how to design the API.

JWT

Somleng's Carrier Webhooks are signed using JWT (RFC 7519). This provides a standard way for applications to verify webhooks.

Design for Scale

Somleng is a tool which can be used across the globe. The technology can be applied to hundreds of different use-cases from mHealth projects to Early Warning Systems to Internet Banking OTP Authentication. Our vision is a world where communications is accessible to everyone. We aim to achieve this vision by giving local carriers and individuals the technology to provide their own cloud communication stacks across the globe.

Design With the User

Somleng is designed with feedback from our customers and partners. We add features in an incremental manner based on the feedback from our partners.