Access Policy

Overview

The EOSC EU Node user access policy ("UAP") defines the access groups, their corresponding access rights, service limits, and virtual credit allocation policies for the users of the EOSC EU Node's Resources and Services as granted by the European Commission. The European Open Science Cloud (EOSC) EU Node is designed to provide researchers with access to computing resources, data services, and collaboration tools.

This policy applies to all users of the EOSC EU Node, covering access to Services and Resources, with the underlying infrastructure, provided through the EOSC EU Node. The policy outlines how users are categorised into access groups, their corresponding rights, obligations, and resource usage limits. 

Access Groups

Access Group Overview

The EOSC EU Node provides different levels of access based on user roles and affiliations. Each access group has specific rights, limits, and credit allocations designed to meet different user needs. 

For details on authentication methods and how they affect your access group eligibility, please see the Authentication section.

Access Group Types

The EOSC EU Node provides four access levels with increasing capabilities:

For further details on each user group, consult the user access policy.

Access Comparison

The following table provides a detailed comparison of features, services, and credit allocations across access groups:

Changing Your Access Group

If you think you are eligible for a different access group or if your access rights don't match your institutional role, follow these steps:

1. Check your User Settings to see your current access group and identity attributes
2. Contact your institution's identity provider (IdP) if your role information (e.g., eduPersonAffiliation) is incorrect
3. If the issue persists, submit a ticket to the EOSC EU Node Helpdesk with your current access group, expected access group, and institutional role

Credits & Resources

What Are Credits

Credits are virtual units you can use to access services on the EOSC EU Node. They don't have any monetary value and are consumed only when you reserve and/or actively use services like: 

• Launching interactive notebooks or virtual machines
• Running workflows or containers
• Transferring or storing files

Credits are provided to you free of charge (at the point of use) by the European Commission the first time you log in. You can find all your spending history and remaining credits in your personal wallet.

How Credits Work

Service Costs: Each service has a credit cost depending on its size and how long you use it, however some services have no size. The environment size indicates the service limit reserved for you, i.e., how many resources you can use and how many credits it will cost. For instance, a resource-intensive service may cost 10 credits per day, while a lighter service may only cost 0.5 credits per day. You can view and compare the costs of all service offers on their individual pages in your personal workspace, once you log in to the User Space. For a quick overview on costs and service environment sizes, please refer to the tables below:

The following services have no size.

Service environment sizes:

Consuming Credits: When you order a service for a specified period, the total credit cost of the service reservation will be deducted from your wallet. You can use your credits on any available service, provided you have sufficient credits in your wallet.

Releasing a Service: If you cancel a service before the end of its reservation term, you will receive a refund in credits for the unused service duration in time.

Credits Replenishment: Credits refresh every 90 days, starting from your first login. Unused credits expire at the end of the period for all services, except for credit grants. Reserved service environments are deactivated upon reservation revoked by the user or automatically ended due to credit or time expiration. Reactivation is possible via Helpdesk request according to the data/infrastructure retention policy.

Credits for Groups: When you create a group, a separate Group Wallet will automatically be generated. This wallet is independent of your personal wallet and comes pre-allocated with additional credits, which you can manage and spend in collaboration with your group members. 

Credit Default Allocation

The exact number of credits you receive, as well as your level of access to various services, are set automatically based on the affiliation information shared by your home organisation. 

Additional Credit Requests

Users requiring additional credits or extended access beyond their default allocation must submit a request through the Helpdesk. These requests will be reviewed on a case-by-case and best-effort basis (i.e., not guaranteed).

When requesting additional credits, be prepared to provide information about:

• Your research project and its objectives
• The expected duration of your need for additional resources
• A justification for why the standard credit allocation is insufficient
• Your specific resource requirements (e.g., GPU usage, storage needs)

Credit Grants

Grants of up to 40,000 credits may be provided to EC-funded research and innovation projects (one grant per project) to be used during the project’s duration and exclusively for the needs of the project.  

The credit grant is allocated to one EOSC EU Node Group created by the Project Coordinator (Group owner) and is not replenished (one-time grant) nor expires between periods. In case the Project Coordinator is not an Investigator, they can request to be elevated to this level (via submitting a Helpdesk ticket), or they may delegate the creation of the group to another member of the project.  

Information for the Project Coordinator to include in the ticket: 

• Grant Number
• EC Project Officer
• Group Project ID and Owner
• A concise description of the intended use of EEN services.  

After evaluation and validation of the request and depending on the available resources of the EOSC EU Node, the credit grant is allocated to the indicated Group Project’s wallet. Requests for higher and/or additional credit grants will be reviewed on a case-by-case and best-effort basis (i.e. not guaranteed).  

Credits Use Cases

A Faculty member from a European university is preparing a new publication and decides to utilise the services and resources offered by the EOSC EU Node. The researcher logs in to the EOSC EU Node using their home credentials issued by the university. As a faculty member of a university from an EU27 country, the researcher automatically gets 2000 credits allocated in their wallet for free, courtesy of the European Commission.

The researcher browses through the available services of their personal User Space, such as File Sync & Share, Virtual Machines, Cloud Container Platform, and Interactive Notebooks, and decides to use a particular service. Specifically, in our scenario, the researcher spends 10 credits for the File Sync & Share service (to store and share files and folders safely and securely) and 200 credits for deploying scientific software on Virtual Machines to perform experiments. As the researcher progresses with their experiment, the credits are automatically replenished every three months. This ensures a continuous allocation of credits to support ongoing research activities up to the limit of their wallet.

Midway through the first six months, the researcher has prepared a research software with particular configurations and wants to make it available to others to use. The researcher visits the Tools Hub, creates a TOSCA template automating the deployment of the software on the EOSC EU Node, and submits it for publishing. The tool will be validated and then publicly released to other users (also available in the Resource Hub), enabling them to deploy it automatically on the EOSC EU Node in a matter of minutes to reproduce the experiment.

The researcher then decides to prepare Jupyter Notebooks, which enable others to collaborate and extend the analysis of the published research work. For this reason, the researcher allocates credits on the Notebook service, carefully preparing and testing a collection of Notebooks to share with colleagues. However, the researcher realises that assistance and contributions are needed from others and so creates a group project in the EOSC EU Node, inviting colleagues. They collectively now prepare and publish a series of portable Notebooks, which can be used for educational and research purposes within or outside the EOSC EU Node.

Throughout this journey, the EOSC EU Node supports the researcher at various stages of the research and scholarly communication lifecycle, enabling them to turn the vision of Open Science for Europe into practice. 

Authentication & Authorisation

Introduction to Authentication & Authorisation

Authentication and authorisation determine your access level on the EOSC EU Node. Your access is based on your login method, and the role attributes provided by your institution or identity provider, as well as information about your home country determine whether you will be authorised to use EOSC EU Node services, and which access level you will be assigned to. EOSC uses trusted login systems via AAI to verify your identity and institutional role. 

Login Methods and Role Requirements

Anyone can log into the EOSC EU Node via the authentication methods listed below. Each of these methods consider specific role and country requirements that determine authorisation, i.e., access group eligibility: 

Using the EU Login service of the European Commission, users can also self-register themselves and create an account. However, this may not guarantee any authorisation to use services, but only successful authentication to the EOSC EU Node (i.e., Observer AP-A access).

If your role information is incorrect or missing, you may be placed in a lower access group than you qualify for. Contact your institution's identity provider to ensure they are correctly sharing your role attributes. 

Authentication Methods

If your role information is incorrect or missing, you may be placed in a lower access group than you qualify for. Contact your institution's identity provider to ensure they are correctly sharing your role attributes. 

Authentication Process

The authentication process involves the following steps:

1. Select Authentication Method
   Choose your identity provider from the available options (eduGAIN by clicking "Add another institution), EU Login, or eIDAS via the EU Login page).
2. Login with Identity Provider
   Enter your credentials at your organisation's login page. This keeps your password secure as it is never shared with the EOSC EU Node.
3. Attribute Release
   Your identity provider sends your role and organisation information (but not your password) to the EOSC EU Node based on your explicit privacy consent given at the first login attempt.
4. Access Group Assignment
   Based on the attributes received, the EOSC EU Node automatically assigns you to the appropriate access group. 

Troubleshooting Login Issues

If you encounter problems with authentication or believe you are assigned to the wrong access group:

1. Check your User Settings, accessible in your User Space, to see your current access group and the attributes received from your identity provider
2. Verify your institutional role with your organisation's IT department
3. Contact your identity provider to ensure they are correctly sharing your role information (such as eduPersonAffiliation)
4. Submit a ticket to the EOSC EU Node Helpdesk if the issue persists

Additional Policies

This section covers key areas including the enforcement and modification of policies, where violations may lead to termination of access, users will be notified in the case of any changes. Emphasizing user responsibility for personal data and compliance with home institution policies, data privacy is addressed in these policies. Security protocols require users to report incidents and follow best practices, with consequences for non-compliance. A disaster recovery plan ensures data integrity through regular backups. Users are responsible for their own equipment, data backups, and legal compliance. The EOSC EU Node limits liability for service interruptions and third-party services. Key contacts are provided for support, data protection, and security issues. 

Policy Enforcement and Modification

The EOSC EU Node's policies are enforced by the Operating Unit (in particular, the EOSC EU Node administrators). These policies ensure fair usage, security, and compliance with EU regulations while providing appropriate access to resources for research and collaboration.

Enforcement

Any violation of EOSC EU Node policies may result in the suspension or termination of user access. The Operating Unit reserves the right to audit access logs and user activities to ensure compliance with all policies.

Updates and Changes

Policy Changes: The Operating Unit reserves the right to modify policies at any time. Users will be notified of significant changes, and continued use of the Services and Resources implies acceptance of the updated terms.

Service Updates: The Operating Unit may release software updates, including security patches or new features. Users are required to update their software (if needed) to continue using the Services and/or access the Resources.

Service Modifications: The Operating Unit may decide to modify or discontinue Services or Service features and functionalities at its discretion. Users may lose access to certain functionalities, Services and/or Resources (including content and data), without prior notice.

Data Privacy and Control

Users accessing Services and Resources through federated identities (IdPs) acknowledge that their home organisation may have control over their account and personal data. The Operating Unit may notify home organisations about the usage and the corresponding personal data associated with such federated accounts, especially in cases of compromised personal data.

Privacy

The Operating Unit of the EOSC EU Node respects user privacy but assumes no liability for any personal data management by third parties associated with federated identities. Users must comply with their home institution IdP's privacy policies and other guidelines.

Termination and Personal Data Retention

Upon termination of a user's access (whether by the user itself or the Operating Unit), access to Services and Resources and the associated personal data will be immediately revoked. The Operating Unit will delete or disassociate corresponding data, except where legally required to retain it. Users are advised to maintain regular backups of their user data.

Any remaining credits or reservations will be forfeited upon termination, and there will be no reimbursement for unused Credits.

Computer Security and Incident Response

The Operating Unit of the EOSC EU Node is committed to ensuring the security and integrity of its Services and Resources, content and user data processed within the EOSC EU Node. In the event of a computer security incident, the Operating Unit will follow established procedures to identify, mitigate, and respond to any security threats or breaches.

EOSC EU Node administrators will promptly investigate all reports. Users who fail to follow the security standards applying to all European Commission information systems or who are found to be responsible for a security incident due to negligence or misconduct may face access restrictions, suspension, or termination of their account.

In the case of a significant security breach, the Operating Unit will inform affected users and organisations in a timely manner. Notifications will include details about the incident, any data compromised, and recommended actions users should take.

Disaster Recovery

The Operating Unit of the EOSC EU Node is committed to ensuring the continuity and availability of its Services and Resources in the event of a disaster. The EOSC EU Node has an established Disaster Recovery Plan (DRP) designed to minimise service disruptions, protect data integrity, and restore normal operations as quickly as possible.

Regular backups of critical systems and user data are performed. These backups are securely stored in geographically dispersed locations to ensure data availability in the event of a localised disaster. Backup frequency and retention policies are aligned with EU regulations on data protection and disaster recovery.

User Responsibilities

Equipment and Connectivity

Users are responsible for providing the necessary equipment (e.g., internet connection, devices) to access EOSC EU Node Services and Resources. The Operating Unit is not liable for any additional costs incurred by users for their connectivity or equipment.

Maintaining Backup Copies

Users are responsible for maintaining backup copies of any critical content and data they store within the EOSC EU Node's Services and Resources. Users should follow best practices for data protection and ensure they are aware of the EOSC EU Node's recovery procedures.

Legal Compliance

Users agree to use the Services and Resources in compliance with applicable laws and regulations. Misrepresentation of location or identity to bypass service restrictions is prohibited.

Limitation of Liability

General Liability

The EOSC EU Node provides its services on an "as-is" and "as-available" basis. To the maximum extent permitted by applicable law, the Operating Unit of the EOSC EU Node and its affiliated parties (i.e., onboarded third-party service and resource providers) will not be liable for any direct, indirect, incidental, consequential, or special damages arising out of or in connection with the use of the Services and Resources, even if advised of the possibility of such damages. This includes, but is not limited to, damages for loss of profits, data, or other intangible losses.

Service Availability

The EOSC EU Node strives to ensure the availability and reliability of its services. However, the Operating Unit of the EOSC EU Node makes no guarantees regarding the uninterrupted or error-free operation of its Services and Resources, the accuracy of any information, content or data provided through the Websites, or the ability of the Services to meet the user's specific needs.

Services and Resources may be unavailable from time to time due to maintenance or unforeseen disruptions. The Operating Unit of the EOSC EU Node does not guarantee continuous availability of Services and is not liable for any data loss resulting from service outages.

Data Integrity

While the EOSC EU Node implements strong security measures to protect user data, the Services and Resources cannot guarantee absolute security. Users are solely responsible for ensuring they maintain appropriate backups of their own data. The Operating Unit of the EOSC EU Node will not be liable for any data loss or corruption arising from the use of its Services and Resources.

Third-Party Services and Resources

The EOSC EU Node may integrate with or provide access to third-party services and resources as a federated system of systems. The Operating Unit of the EOSC EU Node makes no warranties or representations about these third-party services and resources and will not be liable for any issues arising from their use, users assume all risks associated with their use. Users are responsible for reviewing and agreeing to the terms of service of any third-party services and resources they utilise through the Websites. Third-party terms do not alter this user access policy.

Legal Compliance

The Operating Unit of the EOSC EU Node makes every effort to comply with applicable laws and regulations. However, users are solely responsible for ensuring their use of the Services and Resources complies with any applicable legal and regulatory requirements. The Operating Unit will not be liable for any user's failure to comply with such laws.

Force Majeure

The Operating Unit shall not be liable for any failure to the EOSC EU Node's Services and Resources its obligations under this policy if such failure results from causes beyond its reasonable control, including but not limited to natural disasters, acts of war, terrorism, labour disputes, or governmental actions.

Key Contacts

For assistance with policies, security concerns, or data protection issues, please reach out to the appropriate contact:

• Helpdesk Support: EOSC EU Node Helpdesk
• Data Protection Officer: data-protection-officer@ec.europa.eu
• Computer Security Incident Response Team (CSIRT): security@open-science-cloud.ec.europa.eu
• Security Contact for the UAP: CNECT-LISO@ec.europa.eu

Help & Support

How Can We Help You?

The EOSC EU Node Helpdesk is your central point of contact for all questions, issues, and support needs related to the EOSC EU Node platform.

Submit a Support Ticket

Helpdesk Support Services

The EOSC EU Node Helpdesk provides comprehensive support for all aspects of the platform. Our dedicated team is ready to assist with:

• Access Rights and Authentication Issues - Problems with login, incorrect access group assignments, or missing institutional attributes
• Service Troubleshooting - Assistance with virtual machines, containers, notebooks, and other platform services
• Credit and Resource Requests - Applications for additional credits or special resource allocations
• Policy Clarifications - Help to understand and navigate EOSC EU Node policies
• Technical Guidance - Advisory support for utilising EOSC EU Node resources effectively

Response Times

Our support team strives to respond to all inquiries promptly (response times are not guaranteed):

• General inquiries: Within 1-2 business days
• Technical issues: Within 1 business day
• Critical system problems: Priority response
• Credit/resource requests: Within 3-5 business days

Access Group Support

If you believe you've been assigned to the wrong access group or have limited access, follow these steps:

1. Check your User Settings, available in your User Space
   • View your current access group
   • Check your information, and more specifically, your affiliation attribution
2. Contact your institution
   • Ask your identity provider (IdP) to fix missing or incorrect attributes like eduPersonAffiliation
3. Still need help?
   • Open a ticket with the EOSC EU Node Helpdesk for assistance

Requesting Additional Credits

If you require additional credits beyond your default allocation, you can submit a request through the Helpdesk.

Information to Include in Your Request

To expedite your request, please provide the following details:

• Project Description: Brief overview of your research or project
• Resource Justification: Why you need additional credits
• Duration: How long you'll need the extended resources
• Current Usage: How you've utilised your existing allocation
• Specific Services: Which services you plan to use (VMs, containers, notebooks, etc.)