IP, Confidentiality, and Information Security

Intellectual Property

As a part of the value a Clinic collaboration can provide to sponsors, the Clinic program and sponsor mutually agree that all intellectual property (IP) developed over the course of a project will belong to the sponsoring organization. We see this as a fair exchange for the efforts the sponsors make on behalf of the program, the fee they pay, and the confidence they place in Clinic's participants. 

Of course, not all projects have a commercial product as an ultimate goal. Sometimes, even with commercial sponsors, the projects are producing software to be released under an open-source license. Still other projects, e.g., with government labs, require that all results be public.

Confidentiality and NDAs

The Clinic Directors choose projects that place the fewest limitations on the ability of students to discuss their work. For example, we do not accept projects that make it impossible to present meaningfully (though restrictions on presenting a few key details may be deemed acceptable).

In all cases, the Clinic program promises each sponsor that you will protect internal documents and materials. To that end, we expect the project team to act responsibly in handling such documentation and also require all Clinic students to sign a Clinic Agreement at the start of the year.

Some sponsors may have further concerns about confidentiality and ask you to sign an additional non-disclosure agreement (NDA). Do not sign a sponsor-provided NDA until a Clinic Director has reviewed and approved it, so we can make sure it contains no unreasonable demands in the Clinic context. 

Licensing Restrictions

There are many useful software tools and packages available on the web, but just because they are free to download or install does not necessarily mean they come with no obligations.

Pay careful attention to the license requirements of any software package or tool you use. Many disclaim responsibility for things going wrong, but require nothing from you. Some require acknowledgement (e.g., in a README). Others forbid use in commercial context, or prevent distributing the software without also distributing the source code ("copyleft"). Depending on the project, some licenses might be non-starters for the sponsor, and you'll need to find or create alternatives. 

Information Security

Sponsors' requirements for protecting internal documents and materials can vary widely, so it's vital to discuss expectations with your liaisons early and uphold all agreements! A project where you contribute to an open-source project probably has few concerns, but sponsors who provide confidential code, data, or documents (or who plan to keep your project results confidential) may have restrictions on how this confidential information can be stored, accessed, and/or discussed.  

Using Personal Machines

• You may not copy confidential documents or data onto personal laptops (or desktops, or any other non-Clinic machine) without prior approval from your liaison.

• If you do get permission to use a personal machine, your machine must  be well-secured, including a strong password, an encrypted hard drive (e.g., Windows BitLocker or macOS FileVault), and malware/antivirus software even if it's a Mac or Linux machine.  (CIS offers Microsoft Defender if you don't have antivirus software already installed.)

• If a machine with confidential Clinic data on it is hacked, lost, stolen, or otherwise potentially compromised, inform the Clinic Directors and CIS immediately. (When you first signed onto the campus network you promised to let CIS know if your computer is hacked so they could look for collateral damage; we need to know too.)

Cloud Storage and Services

• Confidential or proprietary data must not be "stored in the cloud" or processed online (e.g., a PDF parsing service) unless you get explicit permission from the liaison. This restriction applies even to college-licensed Google and Microsoft services.

  • If your sponsor views Google as a competitor, even storing their data or your reports on Google Docs/Drive could be problematic. 

  • Similarly, if Microsoft is considered a competitor, use of OneDrive, collaborative editing with MS Word for the web, and possibly even storing code on GitHub could be an issue.

  • In the case of such restrictions, the sponsor can usually connect you to an alternative such as letting you use whatever cloud storage they use internally.

• There are often sponsor restrictions on use of AI chatbots (for brainstorming, text editing) or AI coding assistants.  (See also LLMs in Clinic.)

Clinic Spaces

• You should take all reasonable precautions like keeping confidential other physical work products locked away.

• All systems containing Clinic data must use strong passwords for all purposes. This applies not just to login passwords, but also passwords for any network-connected services you run, like database servers or web servers,  as well as any software you build that accepts connections from the network.

Backups and Version Control

• Avoid single points of failure, e.g., by ensuring that all code and data is stored in more than one place or can be regenerated.

• Hosting code on GitHub or another version-control site of the sponsor's choosing is a good way to avoid the loss of code. All projects should be using some form of version control anyway!

• Having copies of files on multiple computers, or on computers and the cloud, is also a plausible backup strategy as long as the sponsor is OK with using these locations.

• Periodically confirm that important files can be recovered.

• If sponsor restrictions prevent approved cloud or remote storage, request an external backup disk and store it securely.

General Security

• Never commit passwords, API access tokens, or other secrets into version control.

• At the end of the project, follow sponsor instructions for returning or deleting confidential information and remove personal copies.

• When uncertain whether information is confidential, treat it as confidential until the liaison confirms otherwise.