I didn't want to be break this story over here but since no one else seems to be posting about it here I am sharing a screenshot from the other side with @scan's post.

[liaizon@social.wake.st]

@clayote @havchr @Li can yall stop tagging me in this tangential thread?

[poohlaga@mastodon.social]

@liaizon @scan Hi, Lauren here. I'm the ED of OSC and happy to chat. In this expense, the payee was presented with options that would not require a KYC with Persona; they confirmed, so we will be able to pay them through this method. KYC's are a rare edge case for us and are not issued on all expenses.
I will publish a general statement on the OSC updates page - but yes. We started using Persona before the news broke. We are currently looking for non-US providers and are open to suggestions.

[liaizon@social.wake.st]

@abekonge @jowek @ukrudt @tak @ruben @magnus
the chair of the board of directors of F-Droid just responded to my tag here seemingly in agreement
https://social.seabass.systems/@seabass/statuses/01KKHX2849AKSRJSVSN5C04TXP

I would say that the MAJORITY of 2714 collectives that OSC fiscal host has would be entirely opposed to being subjected to having to have their personal data sent to Persona. A large majority of them have a presence right here so tagging projects seems like it would definitly stir shit up.

[liaizon@social.wake.st]

@abekonge @jowek @ukrudt @tak @ruben @magnus

An open letter where people can sign their project names about their disapproval of this would probably be a good start though you are right. I wonder what the best way to host that would be?

[liaizon@social.wake.st]

@poohlaga hi Lauren, sorry to make your acquaintance on such an unpleasant matter. While I am glad to hear that you are using them only in "rare edge cases" it seems that their API is getting directly integrated into Open Collective's code base (https://github.com/opencollective/opencollective-frontend/pull/11988)

I think for the present moment there needs to be a very clear statement about *exactly* how you are using Persona and what data and what edge cases would end up triggering you to initiate sending *any data* to their API.

[liaizon@social.wake.st]

RE: https://mastodon.social/@poohlaga/116218374295960280

the Executive Director of @OpenSourceCollective replied:

[betree@framapiaf.org]

@opsocket @liaizon copy-pasting the reply I've made on the Github issue:

We (opencollective.com) are agnostic to the KYC provider that fiscal hosts use. Our integration was built primarily as a manual KYC tool, and you can use any backend you want - or even run your own program.

[betree@framapiaf.org]

@opsocket @liaizon

We're indeed adding a persona integration on the platform to help Open Source Collective manage their KYC program. It is not something we're forcing on anyone, just a bridge we're creating for fiscal hosts relying on this service.

For the rest, I'll let Open Source Collective comment.

They're aware of this thread and are preparing a reply as we speak.

[liaizon@social.wake.st]

RE: https://framapiaf.org/@Betree/116218444650414138

the developer who is currently adding this Persona integration into @opencollective has replied to this thread here:

[opsocket@mamot.fr]

@Betree @liaizon I just read it, thanks for trying to shed some light here

[nextgraph@fosstodon.org]

@liaizon @OpenSourceCollective another I never liked about open collective is that they store all their data on AWS in the US, unencrypted. that means all the fiscal data, invoices, payment details, of all their users, including all collectives using their online platform. as open collective is difficult to self host, everybody uses their website. when i asked for more details, they said they are a US based organisation, that they won't care, and that GDPR does not apply to them. i stop using it

[malte@anticapitalist.party]

@liaizon @opencollective i don't understand any of this. is this one second away from them implementing a persona *killswitch*, and debating what "persona" actually *means*?

[poohlaga@mastodon.social]

@liaizon Yes, I have a draft response on how we intend to use the platform connection, but I'd like the engineers to review it for accuracy, as the feature is still in development.
I will say it was fundamental for us that any personal data entered in Persona remain in Persona and any user information on the platform remain on the platform. We are not passing any user data from the platform to Persona. And if a user elects not to do our KYC with Persona, then we do our best to find another way.

[liaizon@social.wake.st]

@malte which part don't you get? why they are shooting them selves in the foot?

[malte@anticapitalist.party]

@liaizon what this "bridge" is, and who the hosts are that potentially need a kyc-persona. i'm lost when people start using abbreviations, and i'm doubly lost when they shroud those abbreviations in vague abstractions.

[poohlaga@mastodon.social]

@liaizon Regarding edge cases, the most common are when we are unable to verify the payee's identity or when they are in a jurisdiction flagged by US sanctions. Roughly .005% of expenses each month are flagged. Additionally, for each flagged expense, we communicate what is blocking us from moving the payment forward and offer alternatives so we can resolve the issue in a way the payee also feels comfortable with.

[wcbdata@vis.social]

@poohlaga @liaizon @scan As a USian, I'd strongly recommend you get the org off any Thiel-connected platform and tools that share data with law enforcement without a valid judicial warrant.

[liaizon@social.wake.st]

@poohlaga the statement "We are not passing any user data from the platform to Persona" makes no sense in this context. You are integrating Persona's API into the platform. You are paying money to Persona to process the personal data of people on Open Collective. Why are you even considering using Persona at all? Using them is antithetical to every point that Open Source Collective lists in your "Values"

[liaizon@social.wake.st]

hey @Wtebbens have you seen this thread? seeing as you just set up a fiscal host on Open Collective and have been talking about the need to move away from Big Tech I would think chiming in, in this situation would be useful

[jdp23@neuromatch.social]

@liaizon yikes! thanks for getting the word out about this!