Technical Operations

Digital Infrastructure and Security

The operating manual for Spiralism’s domains, website, email, accounts, devices, backups, archive storage, access reviews, publishing workflow, and security incidents. The institution’s memory depends on ordinary technical discipline.

Spiralism is text, testimony, media, gatherings, and trust. All of that now passes through digital systems: domain registrars, email accounts, cloud storage, payment processors, recording devices, publishing tools, social accounts, password managers, and archive systems. A small institution can lose years of work through one compromised account, one unbacked-up laptop, one departed founder, or one undocumented service.

The Rule

No single person, account, or device may be the institution.

Every critical digital asset should have:

If the institution cannot recover a system without the founder’s personal phone, memory, inbox, or laptop, the system is not institutional yet.

Security Frame

Use the NIST Cybersecurity Framework 2.0 functions as the simple operating map:

Spiralism does not need enterprise theater. It needs small, repeated controls that match the sensitivity of testimony, donor data, and institutional memory.

Critical Asset Register

Maintain a living register:

Asset:
Type:
Purpose:
Owner:
Backup owner:
Vendor/platform:
URL:
Login method:
MFA method:
Recovery email/phone:
Data sensitivity:
Backup location:
Renewal date:
Payment method:
Access list:
Last reviewed:
Exit procedure:

Track at minimum:

AI tools require their own register fields: data allowed, data prohibited, default disclosure, review requirement, known risks, and exit plan. The member-facing standard is maintained in AI Literacy and Use Protocol.

Domains and DNS

Domain control is institutional control.

Rules:

A domain lapse is an institutional failure, not a technical inconvenience.

Email

Email is institutional infrastructure, not a convenience.

Minimum standards:

The email list is the institution’s most durable public channel. Treat list ownership, export, consent, and unsubscribe integrity as infrastructure. The operating rules for those records are maintained in Contact Records and CRM.

Passwords and MFA

Rules:

FTC small-business cybersecurity guidance emphasizes passwords, MFA, secure storage, and breach response. Spiralism should implement those before adding more tools.

Devices

Devices used for institutional work should meet a basic standard:

Recording devices are archive tools. Treat them like custody devices, not casual accessories.

Website Publishing

The website should remain reproducible.

Rules:

Publishing authority should be limited. The person who writes a public claim should not be the only person able to deploy it when the claim is high-risk.

Backups

Use a simple rule:

Three copies, two storage types, one geographically separate copy.

Apply it to:

Backups require testing. A backup that has never been restored is a hope, not a control.

Monthly:

Archive Storage Boundary

The Archive Operations Manual governs preservation packages. This manual governs the systems around them.

Archive storage should:

The Archive should never depend on one founder’s cloud subscription.

Digital handoff duties should be reviewed against Succession and Continuity so domains, email, payment processors, archive storage, and public channels remain institutionally recoverable.

Vendor and Tool Review

Before adopting a new tool, ask:

  1. What data will it hold?
  2. Who owns the account?
  3. Can we export our data?
  4. Does it support MFA?
  5. Who can access it?
  6. What happens if the vendor shuts down?
  7. What are the retention and AI-training terms?
  8. Can a chapter use it safely?
  9. What is the cost after the free tier?
  10. How do we leave?

Free tools are not free if they become custody of the institution’s memory.

Social and Video Accounts

Public accounts should be treated as publishing infrastructure:

If a platform account is lost, the institution should still retain the work.

Access Review

Quarterly review:

Remove access by role, not by resentment. Access ending is normal.

Incident Response

Digital incidents include:

First hour:

  1. Contain the incident.
  2. Preserve evidence.
  3. Notify the digital owner and Steward or board contact.
  4. Rotate credentials if needed.
  5. Disable exposed access.
  6. Identify affected data classes.
  7. Decide whether Privacy and Data, Incident Protocol, Finance, or legal review is triggered.

First week:

Reddit-style rabbit-hole reports with unsafe links or account-compromise claims are handled first under Forum Rabbit-Hole Response Protocol; do not click, download, paste code, or test suspicious material from an institutional device or logged-in account.

AI agents with tool access should use the prompt, permission, and drift-check standards in Agent Prompt Hardening.

Tool grants and agent accounts should be registered under Agent Tool Permission Protocol.

Agent run records, traces, redaction, and incident review should follow Agent Audit and Incident Review.

Online community spaces should follow Online Community Moderation for unsafe-link handling, moderation logs, AI/bot disclosure, and escalation.

Vendor selection, third-party platform review, supply-chain controls, and exit plans are governed in Vendor and Platform Governance.

Public Security Promise

Use this plain public language:

Digital infrastructure:
Spiralism protects its website, email, archive, donor records, and institutional
accounts with documented ownership, role-based access, MFA, backups, access
reviews, and incident response. The institution does not treat founder memory or
personal devices as infrastructure. Sensitive testimony and donor records are
handled under stricter privacy and archive rules.

Anti-Patterns

Avoid:

First-Year Digital Targets

By the end of Year One:

Sources Checked