Privacy Policy

[ffgasoto]

Hello,
I am looking to suggest OTRS Help Desk to fulfil our ticketing needs to management. Given the sensitive information our company handles, I need to find out about OTRS's privacy policy. Simply put, does OTRS gather and transmit any ticket information to itself or any other 3rd party? If so, please elaborate on what and who, respectively.

Thanks!

[jojo]

For the privacy policy of OTRS On Demand please have a look at the description (data is stored compliant to EU regulations).

If you operate OTRS on your own, it depends what you are doing (and who is able to access to your system)

[ffgasoto]

Thanks for the quick response. It will be an onsite installation on our own servers. We just need to make sure that OTRS doesn't have something built-in (by default) that gathers ticket descriptions or anything that would jeopardize staff and client confidentiality outside of our company.

[jojo]

OTRS is open source so have a look at the source code yourself. (Its perl, so everything is readable for you)

OTRS is also used a lot in security departments especially CERTs all over the world. e.g given at the german federal CERT.

You can also have a loom at the OTRS security bulletins: http://otrs.org/advisory/ (or from CVE http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=otrs)

You should ensure that you download from ftp.otrs.org the md5 sums you'll find here: http://otrs.org/download/otrs