<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>I've been toying with Claude to have the Great AI fill some of
those forms for me, that is interesting as it reflects maybe how
we should structure our public information.</p>
<p>Here are the answer when asking the same questions. They seem
pretty reasonable, I hope users will read them. <br>
But as long as each IT department will invent its own forms and
questions, we will have these random questions.</p>
<p> Hopefully in 2 of 3 years with more standardized ways of
handling security audits, scan, this should not last. <br>
<br>
</p>
<p>----</p>
<div data-test-render-count="1">
<div class="mb-1 mt-6 group">
<div class="flex flex-col items-end gap-1">
<div
class="group relative inline-flex gap-2 bg-bg-300 rounded-xl pl-2.5 py-2.5 break-words text-text-100 transition-all max-w-[75ch] flex-col !px-4 max-w-[85%]"
style="opacity: 1; transform: none;">
<div class="flex flex-row gap-2 relative">
<div class="flex-1">
<div data-testid="user-message"
class="font-large !font-user-message grid grid-cols-1 gap-2 py-0.5 relative"
style="max-height: none; overflow: hidden; position: relative;">
<p class="whitespace-pre-wrap break-words">"I would
like to work with QGIS, and our cybersecurity team
need to ensure the absence of potential security
issues of your solution."</p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div data-test-render-count="1">
<div class="group"
style="height: auto; opacity: 1; transform: none;">
<div class="contents">
<div data-is-streaming="false"
class="group relative relative pb-3"
style="opacity: 1; transform: none;">
<div
class="font-claude-response relative leading-[1.65rem] [&_pre>div]:bg-bg-000/50 [&_pre>div]:border-0.5 [&_pre>div]:border-border-400 [&_.ignore-pre-bg>div]:bg-transparent [&_.standard-markdown_:is(p,blockquote,h1,h2,h3,h4,h5,h6)]:pl-2 [&_.standard-markdown_:is(p,blockquote,ul,ol,h1,h2,h3,h4,h5,h6)]:pr-8 [&_.progressive-markdown_:is(p,blockquote,h1,h2,h3,h4,h5,h6)]:pl-2 [&_.progressive-markdown_:is(p,blockquote,ul,ol,h1,h2,h3,h4,h5,h6)]:pr-8">
<div>
<div
class="standard-markdown grid-cols-1 grid [&_>_*]:min-w-0 gap-3 standard-markdown">
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]">I'd
be happy to help you work with QGIS! Before we dive
in, let me address your cybersecurity team's concern
transparently.</p>
<h2
class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">About My
Environment</h2>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]">I
have access to a <strong>Linux computer (Ubuntu 24)</strong>
where I can run code and bash commands. Here's what
your security team should know:</p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>Network
Access</strong></p>
<ul
class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3">
<li class="whitespace-normal break-words pl-2">My
network access is currently <strong>disabled</strong>
for bash/computer tools</li>
<li class="whitespace-normal break-words pl-2">I
cannot make outbound connections, download
packages, or communicate with external services
from this environment</li>
<li class="whitespace-normal break-words pl-2">This
means I cannot install QGIS or its dependencies
directly</li>
</ul>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>What
I Can Do</strong></p>
<ul
class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3">
<li class="whitespace-normal break-words pl-2">Write
QGIS Python scripts (PyQGIS) for you to run
locally</li>
<li class="whitespace-normal break-words pl-2">Help
with QGIS configuration files, project files (<code
class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.qgs</code>/<code
class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.qgz</code>),
and automation</li>
<li class="whitespace-normal break-words pl-2">Generate,
analyze, or transform geospatial data (GeoJSON,
Shapefiles, etc.)</li>
<li class="whitespace-normal break-words pl-2">Write
processing scripts, plugins, or workflows</li>
<li class="whitespace-normal break-words pl-2">Analyze
uploaded QGIS files or datasets you share with me</li>
</ul>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>Security
Posture</strong></p>
<ul
class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3">
<li class="whitespace-normal break-words pl-2">I do
not retain data between sessions</li>
<li class="whitespace-normal break-words pl-2">Files
you upload are only used within this conversation</li>
<li class="whitespace-normal break-words pl-2">I
cannot exfiltrate data (network is disabled in my
compute environment)</li>
<li class="whitespace-normal break-words pl-2">All
code I generate is visible and auditable before
you run it</li>
</ul>
<hr class="border-border-200 border-t-0.5 my-3 mx-1.5">
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]">What
would you like to do with QGIS? For example:</p>
<ul
class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3">
<li class="whitespace-normal break-words pl-2"><strong>Automate</strong>
a geospatial workflow with PyQGIS</li>
<li class="whitespace-normal break-words pl-2"><strong>Create
or edit</strong> a QGIS project file</li>
<li class="whitespace-normal break-words pl-2"><strong>Process</strong>
geospatial data (clip, reproject, merge layers,
etc.)</li>
<li class="whitespace-normal break-words pl-2"><strong>Write
a plugin</strong> or custom processing algorithm</li>
<li class="whitespace-normal break-words pl-2"><strong>Analyze</strong>
data you upload</li>
</ul>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Let
me know your use case and I'll get started!</p>
</div>
</div>
</div>
</div>
</div>
<div
class="flex justify-start opacity-0 group-hover:opacity-100 group-focus-within:opacity-100 transition"
role="group" aria-label="Message actions">
<div class="text-text-300">
<div
class="text-text-300 flex items-stretch justify-between">
<div class="w-fit" data-state="closed"></div>
<div class="w-fit" data-state="closed"></div>
<div class="w-fit" data-state="closed"><br>
</div>
</div>
</div>
</div>
</div>
</div>
<p>-----</p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Here
is the security questionnaire filled in accurately for <strong>QGIS</strong>.org
(the open-source Geographic Information System), based on official
QGIS documentation and project pages:</p>
<hr class="border-border-200 border-t-0.5 my-3 mx-1.5">
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>From
a security perspective — answers for QGIS</strong></p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>①
Basic Policy on Information Security</strong>
→ QGIS is an open-source project governed by the QGIS Foundation.
The QGIS community takes security seriously and is aware that QGIS
is deployed in sensitive environments. <span class="inline-flex"
data-state="closed"><a
href="https://qgis.org/resources/support/security/"
target="_blank"
class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer"><span
class="relative transition-colors h-full max-w-[180px] overflow-hidden px-1.5 inline-flex items-center font-small rounded-full border-0.5 border-border-300 bg-bg-200 group-hover/tag:bg-accent-secondary-900 group-hover/tag:border-accent-secondary-100/60"><span
class="text-nowrap text-text-300 break-all truncate font-normal group-hover/tag:text-text-200">QGIS</span></span><span
class="transition-all opacity-[0%] h-[17px] absolute right-[0.5px] inline rounded-r-full flex items-center px-1.5 bg-gradient-to-r from-accent-secondary-900/0 via-accent-secondary-900/100 via-30% to-accent-secondary-900/100 group-hover/tag:opacity-[100%]"><svg
xmlns="http://www.w3.org/2000/svg" width="14" height="14"
fill="currentColor" viewBox="0 0 256 256"
class="transition-all group-hover/tag:ease-out duration-[500ms] ease-in text-accent-secondary-100 group-hover/tag:scale-[100%] scale-[80%] group-hover/tag:opacity-[100%] opacity-[0%] -mr-[2px]"><path
d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"></path></svg></span></a></span>
Security disclosures are handled through a formal Coordinated
Vulnerability Disclosure (CVD) process via a private dedicated
repository, with fixes shipped in point releases as quickly as
possible.</p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>②
Privacy Policy</strong>
→ QGIS values user privacy and provides detailed information on
this topic on its website (qgis.org/resources/support/privacy/). <span
class="inline-flex" data-state="closed"><a
href="https://www2.qgis.org/en/site/forusers/" target="_blank"
class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer"><span
class="relative transition-colors h-full max-w-[180px] overflow-hidden px-1.5 inline-flex items-center font-small rounded-full border-0.5 border-border-300 bg-bg-200 group-hover/tag:bg-accent-secondary-900 group-hover/tag:border-accent-secondary-100/60"><span
class="text-nowrap text-text-300 break-all truncate font-normal group-hover/tag:text-text-200">Qgis</span></span><span
class="transition-all opacity-[0%] h-[17px] absolute right-[0.5px] inline rounded-r-full flex items-center px-1.5 bg-gradient-to-r from-accent-secondary-900/0 via-accent-secondary-900/100 via-30% to-accent-secondary-900/100 group-hover/tag:opacity-[100%]"><svg
xmlns="http://www.w3.org/2000/svg" width="14" height="14"
fill="currentColor" viewBox="0 0 256 256"
class="transition-all group-hover/tag:ease-out duration-[500ms] ease-in text-accent-secondary-100 group-hover/tag:scale-[100%] scale-[80%] group-hover/tag:opacity-[100%] opacity-[0%] -mr-[2px]"><path
d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"></path></svg></span></a></span>
As a desktop application, QGIS processes geospatial data locally
on the user's machine. It does not transmit personal data to
external servers during normal use. The QGIS website itself uses
standard web privacy practices.</p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>③
Third-party certifications (ISMS, P-mark, etc.)</strong>
→ QGIS, as a community-driven open-source project, has not
obtained ISO/IEC 27001 or equivalent certifications. However, the
Swiss National Cyber Security Centre (NCSC) and National Test
Institute for Cybersecurity (NTC) conducted a security audit of
QGIS as part of a pilot project on open-source software security
testing (November 2024 – June 2025), demonstrating external
independent security scrutiny. <span class="inline-flex"
data-state="closed"><a
href="https://en.ntc.swiss/news/2025-reports-oss-ncsc"
target="_blank"
class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer"><span
class="relative transition-colors h-full max-w-[180px] overflow-hidden px-1.5 inline-flex items-center font-small rounded-full border-0.5 border-border-300 bg-bg-200 group-hover/tag:bg-accent-secondary-900 group-hover/tag:border-accent-secondary-100/60"><span
class="text-nowrap text-text-300 break-all truncate font-normal group-hover/tag:text-text-200">Ntc</span></span><span
class="transition-all opacity-[0%] h-[17px] absolute right-[0.5px] inline rounded-r-full flex items-center px-1.5 bg-gradient-to-r from-accent-secondary-900/0 via-accent-secondary-900/100 via-30% to-accent-secondary-900/100 group-hover/tag:opacity-[100%]"><svg
xmlns="http://www.w3.org/2000/svg" width="14" height="14"
fill="currentColor" viewBox="0 0 256 256"
class="transition-all group-hover/tag:ease-out duration-[500ms] ease-in text-accent-secondary-100 group-hover/tag:scale-[100%] scale-[80%] group-hover/tag:opacity-[100%] opacity-[0%] -mr-[2px]"><path
d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"></path></svg></span></a></span></p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>④
Current vulnerability handling</strong>
→ In the 2024–2025 NTC/NCSC audit, a total of six vulnerabilities
were identified in QGIS Server and the QGIS web client (QWC2): one
low-severity issue on the server and five on the web client, two
of which were rated "high." All vulnerabilities were fixed by the
development teams within the 90-day disclosure deadline, and
updated versions are available for download. <span
class="inline-flex" data-state="closed"><a
href="https://en.ntc.swiss/news/2025-reports-oss-ncsc"
target="_blank"
class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer"><span
class="relative transition-colors h-full max-w-[180px] overflow-hidden px-1.5 inline-flex items-center font-small rounded-full border-0.5 border-border-300 bg-bg-200 group-hover/tag:bg-accent-secondary-900 group-hover/tag:border-accent-secondary-100/60"><span
class="text-nowrap text-text-300 break-all truncate font-normal group-hover/tag:text-text-200">Ntc</span></span><span
class="transition-all opacity-[0%] h-[17px] absolute right-[0.5px] inline rounded-r-full flex items-center px-1.5 bg-gradient-to-r from-accent-secondary-900/0 via-accent-secondary-900/100 via-30% to-accent-secondary-900/100 group-hover/tag:opacity-[100%]"><svg
xmlns="http://www.w3.org/2000/svg" width="14" height="14"
fill="currentColor" viewBox="0 0 256 256"
class="transition-all group-hover/tag:ease-out duration-[500ms] ease-in text-accent-secondary-100 group-hover/tag:scale-[100%] scale-[80%] group-hover/tag:opacity-[100%] opacity-[0%] -mr-[2px]"><path
d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"></path></svg></span></a></span>
QGIS is not a CVE Numbering Authority (CNA), so it does not emit
CVE identifiers itself. <span class="inline-flex"
data-state="closed"><a
href="https://qgis.org/resources/support/security/"
target="_blank"
class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer"><span
class="relative transition-colors h-full max-w-[180px] overflow-hidden px-1.5 inline-flex items-center font-small rounded-full border-0.5 border-border-300 bg-bg-200 group-hover/tag:bg-accent-secondary-900 group-hover/tag:border-accent-secondary-100/60"><span
class="text-nowrap text-text-300 break-all truncate font-normal group-hover/tag:text-text-200">QGIS</span></span><span
class="transition-all opacity-[0%] h-[17px] absolute right-[0.5px] inline rounded-r-full flex items-center px-1.5 bg-gradient-to-r from-accent-secondary-900/0 via-accent-secondary-900/100 via-30% to-accent-secondary-900/100 group-hover/tag:opacity-[100%]"><svg
xmlns="http://www.w3.org/2000/svg" width="14" height="14"
fill="currentColor" viewBox="0 0 256 256"
class="transition-all group-hover/tag:ease-out duration-[500ms] ease-in text-accent-secondary-100 group-hover/tag:scale-[100%] scale-[80%] group-hover/tag:opacity-[100%] opacity-[0%] -mr-[2px]"><path
d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"></path></svg></span></a></span></p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>⑤
Password policy</strong>
→ QGIS uses a master password system to protect its local
authentication database (qgis-auth.db). Users must define a master
password when first storing any encrypted credentials. After three
incorrect password attempts, the system offers to erase the
database — there is no way to retrieve or override a forgotten
master password. <span class="inline-flex" data-state="closed"><a
href="https://docs.qgis.org/3.40/en/docs/user_manual/auth_system/auth_overview.html"
target="_blank"
class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer"><span
class="relative transition-colors h-full max-w-[180px] overflow-hidden px-1.5 inline-flex items-center font-small rounded-full border-0.5 border-border-300 bg-bg-200 group-hover/tag:bg-accent-secondary-900 group-hover/tag:border-accent-secondary-100/60"><span
class="text-nowrap text-text-300 break-all truncate font-normal group-hover/tag:text-text-200">QGIS
Documentation</span></span><span
class="transition-all opacity-[0%] h-[17px] absolute right-[0.5px] inline rounded-r-full flex items-center px-1.5 bg-gradient-to-r from-accent-secondary-900/0 via-accent-secondary-900/100 via-30% to-accent-secondary-900/100 group-hover/tag:opacity-[100%]"><svg
xmlns="http://www.w3.org/2000/svg" width="14" height="14"
fill="currentColor" viewBox="0 0 256 256"
class="transition-all group-hover/tag:ease-out duration-[500ms] ease-in text-accent-secondary-100 group-hover/tag:scale-[100%] scale-[80%] group-hover/tag:opacity-[100%] opacity-[0%] -mr-[2px]"><path
d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"></path></svg></span></a></span>
Password complexity rules are not enforced natively by QGIS
itself; they depend on the operating system or enterprise
deployment configuration.</p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>⑥
Multi-factor authentication (MFA)</strong>
→ QGIS desktop does not natively provide MFA for the application
itself. However, QGIS supports a wide range of authentication
methods including PKI certificates, identity bundles (PEM/DER,
PKCS#12), and Basic authentication for connecting to external
services (WMS, WFS, databases, etc.). <span class="inline-flex"
data-state="closed"><a
href="https://docs.qgis.org/3.40/en/docs/pyqgis_developer_cookbook/authentication.html"
target="_blank"
class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer"><span
class="relative transition-colors h-full max-w-[180px] overflow-hidden px-1.5 inline-flex items-center font-small rounded-full border-0.5 border-border-300 bg-bg-200 group-hover/tag:bg-accent-secondary-900 group-hover/tag:border-accent-secondary-100/60"><span
class="text-nowrap text-text-300 break-all truncate font-normal group-hover/tag:text-text-200">QGIS
Documentation</span></span><span
class="transition-all opacity-[0%] h-[17px] absolute right-[0.5px] inline rounded-r-full flex items-center px-1.5 bg-gradient-to-r from-accent-secondary-900/0 via-accent-secondary-900/100 via-30% to-accent-secondary-900/100 group-hover/tag:opacity-[100%]"><svg
xmlns="http://www.w3.org/2000/svg" width="14" height="14"
fill="currentColor" viewBox="0 0 256 256"
class="transition-all group-hover/tag:ease-out duration-[500ms] ease-in text-accent-secondary-100 group-hover/tag:scale-[100%] scale-[80%] group-hover/tag:opacity-[100%] opacity-[0%] -mr-[2px]"><path
d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"></path></svg></span></a></span>
MFA for user workstation access depends on the operating system
and enterprise identity infrastructure in use.</p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>⑦
Can users change their own password?</strong>
→ Yes. The master password can be reset by the user at any time;
the current master password is required before resetting. During
the reset process, there is also an option to generate a complete
backup of the authentication database. <span class="inline-flex"
data-state="closed"><a
href="https://docs.qgis.org/3.40/en/docs/user_manual/auth_system/auth_overview.html"
target="_blank"
class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer"><span
class="relative transition-colors h-full max-w-[180px] overflow-hidden px-1.5 inline-flex items-center font-small rounded-full border-0.5 border-border-300 bg-bg-200 group-hover/tag:bg-accent-secondary-900 group-hover/tag:border-accent-secondary-100/60"><span
class="text-nowrap text-text-300 break-all truncate font-normal group-hover/tag:text-text-200">QGIS
Documentation</span></span><span
class="transition-all opacity-[0%] h-[17px] absolute right-[0.5px] inline rounded-r-full flex items-center px-1.5 bg-gradient-to-r from-accent-secondary-900/0 via-accent-secondary-900/100 via-30% to-accent-secondary-900/100 group-hover/tag:opacity-[100%]"><svg
xmlns="http://www.w3.org/2000/svg" width="14" height="14"
fill="currentColor" viewBox="0 0 256 256"
class="transition-all group-hover/tag:ease-out duration-[500ms] ease-in text-accent-secondary-100 group-hover/tag:scale-[100%] scale-[80%] group-hover/tag:opacity-[100%] opacity-[0%] -mr-[2px]"><path
d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"></path></svg></span></a></span></p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>⑧
Privilege management per user</strong>
→ QGIS Desktop is a single-user desktop application — it does not
have a built-in multi-user privilege management system. Access
controls and user privileges are managed at the OS level or
through connected backend systems (e.g., PostgreSQL/PostGIS
database role permissions, GeoServer access control). For server
deployments, QGIS Server inherits the access permissions of the
web server process.</p>
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>⑨
IdP integration (SAML, SSO, etc.)</strong>
→ QGIS does not natively support SAML or SSO authentication as a
built-in feature for the desktop application. However, QGIS's
authentication framework supports various methods including
PKI-based authentication, OAuth2 (via plugin), and HTTP
authentication <span class="inline-flex" data-state="closed"><a
href="https://docs.qgis.org/3.40/en/docs/pyqgis_developer_cookbook/authentication.html"
target="_blank"
class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer"><span
class="relative transition-colors h-full max-w-[180px] overflow-hidden px-1.5 inline-flex items-center font-small rounded-full border-0.5 border-border-300 bg-bg-200 group-hover/tag:bg-accent-secondary-900 group-hover/tag:border-accent-secondary-100/60"><span
class="text-nowrap text-text-300 break-all truncate font-normal group-hover/tag:text-text-200">QGIS
Documentation</span></span><span
class="transition-all opacity-[0%] h-[17px] absolute right-[0.5px] inline rounded-r-full flex items-center px-1.5 bg-gradient-to-r from-accent-secondary-900/0 via-accent-secondary-900/100 via-30% to-accent-secondary-900/100 group-hover/tag:opacity-[100%]"><svg
xmlns="http://www.w3.org/2000/svg" width="14" height="14"
fill="currentColor" viewBox="0 0 256 256"
class="transition-all group-hover/tag:ease-out duration-[500ms] ease-in text-accent-secondary-100 group-hover/tag:scale-[100%] scale-[80%] group-hover/tag:opacity-[100%] opacity-[0%] -mr-[2px]"><path
d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"></path></svg></span></a></span>,
which can integrate with enterprise identity systems. Full
SAML/SSO integration would typically be handled at the OS or
network layer (e.g., Active Directory, LDAP) rather than within
QGIS itself.</p>
<hr class="border-border-200 border-t-0.5 my-3 mx-1.5">
<blockquote
class="ml-2 border-l-4 border-border-300/10 pl-4 text-text-300">
<p
class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><strong>Note:</strong>
QGIS is a free, open-source desktop GIS application maintained
by the QGIS Foundation — it is not a SaaS product with a
commercial vendor security team. Security posture for enterprise
deployments is significantly shaped by how your organization
configures the OS, network, backend databases, and plugin
management.</p>
</blockquote>
<p><br>
</p>
<pre class="moz-signature" cols="72">Best regards,
Régis Haubourg
Elected member at the Program Steering Comitee of QGIS.org.
-</pre>
<div class="moz-cite-prefix">On 26/02/2026 11:41, Richard
Duivenvoorde via QGIS-PSC wrote:<br>
</div>
<blockquote type="cite"
cite="mid:597f2303-61ef-464d-a058-60718c5eea02@duif.net">Ah
Thanks, that is why I could not find it :-)
<br>
That's another mailbox for me...
<br>
<br>
I'll try to do a rewrite of his paragraph, to make it more
general, and point to commercial service suppliers, this
afternoon, so others can reflect on that.
<br>
<br>
Regards,
<br>
<br>
Richard Duivenvoorde
<br>
<br>
PS sorry for not obfuscating the name of original mail...
<br>
<br>
<br>
On 2/26/26 10:29, Régis Haubourg via QGIS-PSC wrote:
<br>
<blockquote type="cite">To followup, here is a response I did last
week from the security mail (names obfuscated):
<br>
<br>
---
<br>
<br>
Hi,
<br>
<br>
Please note that QGIS is not an online service, but a free and
open source desktop tool with no centralized server collecting
data on your usage of QGIS. Please understand that your form
does not match with what QGIS does. As a community and open
source project, we can't answer individually to your requests,
all the necessary information is available online at qgis.org,
included some standard forms like VPAT.
<br>
<br>
As for vulnerabilities, our security policy is also described
online and you can understand that current disclosures being
worked on can't be disclosed until patched and released.
<br>
<br>
Please take time to understand that QGIS is a GIS that can
connect to many data sources and delegates authentication
methods to the data providers. QGIS supports most of the
protocols and has an internal encrypted password wallet, or can
delegate to the OS wallet.
<br>
<br>
<br>
Best regards,
<br>
<br>
Régis Haubourg
<br>
Elected member at the Program Steering Comitee of QGIS.org.
<br>
-
<br>
<br>
On 22/02/2026 02:10, egsecurity_chd001 wrote:
<br>
<blockquote type="cite">Hi, everyone.
<br>
My name is xxx from CHANGE xxx, Inc.
<br>
We are currently considering using the service 「QGIS」 that you
provide.
<br>
From a security perspective, could you please answer all the
questions below?
<br>
<br>
①What is your company’s Basic Policy on Information Security?
<br>
e.g.) We define and follow the information security
guidelines.
<br>
→
<br>
②What is your company Privacy Policy?
<br>
e.g.) We conformed to P-mark certification in principle.
<br>
→
<br>
③Have you obtained any third-party certifications such as ISMS
or P-mark?
<br>
e.g.) Yes, we have ISMS27001.
<br>
→
<br>
④In terms of vulnerability, do you have any things that you
are currently dealing with ?
<br>
e.g.) Yes, we are working on it since vulnerability has been
identified in XX.
<br>
→
<br>
⑤What is your password policy?
<br>
e.g.) Passwords must adhere to a minimum length of 8
characters with mixture of uppercase and lowercase letters and
numbers.
<br>
→
<br>
⑥Is it possible to set up multi-factor authentication(MFA)?
<br>
e.g.) Yes. Paid plan only.
<br>
→
<br>
⑦Is it possible for all users to change their own password?
<br>
e.g.) Yes.
<br>
→
<br>
⑧Could you grant privileges to each user?
<br>
e.g.) Privileges can be set up by groups.
<br>
→
<br>
⑨Is it possible to connect with idP such as SAML, etc.?
<br>
e.g.) Yes. Only for a paid plan, SSO authentication with MS is
available.
<br>
→
<br>
</blockquote>
<br>
<br>
_______________________________________________
<br>
QGIS-PSC mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:QGIS-PSC@lists.osgeo.org">QGIS-PSC@lists.osgeo.org</a>
<br>
<a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/qgis-psc">https://lists.osgeo.org/mailman/listinfo/qgis-psc</a>
<br>
</blockquote>
<br>
_______________________________________________
<br>
QGIS-PSC mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:QGIS-PSC@lists.osgeo.org">QGIS-PSC@lists.osgeo.org</a>
<br>
<a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/qgis-psc">https://lists.osgeo.org/mailman/listinfo/qgis-psc</a>
<br>
</blockquote>
</body>
</html>