XID Policy Statement

Policy Topics

Information We Collect When You Register Under Self-Service Managed XIDs How We Use Your Email Address What XID Gives You Access To Secure Connection Protecting Logins and Passwords Registration Policy

Information We Collect When You Register Under Self-Service

When you sign up for an XID on the Harvard University managed web site, you provide us with personal information. We request your e-mail address, your name and allow you to choose your own login. When you setup your account, you select a password and establish a personal challenge and response pair that can be used to reset your password. As a registered user, you are able to review and edit your information provided that you can successfully log in to the application.

Managed XIDs

Your XID login may have been obtained on your behalf by an XID account "manager". The XID data that is captured may also include the identity of the person who originally set-up your XID, and notes on what applications you are expected to access using your XID login. The email address of your XID manager will soon be visible to you in "Edit my XID Account"

How We Use Your Email Address

Your e-mail address is used by the XID system to send the following types of e-mail messages: Initial registration. Service notifications related to your account(s). You may also receive e-mail messages from the group that administers the application that you are accessing using your XID. We do not share your e-mail address with anyone inside or outside of the University for them to market their products or services to you. If you provide an invalid email address, you will not be able to be contacted by the application owners, but a false email address will not block access you otherwise would have.

What XID Gives You Access To

As a registered XID user, your XID login and password allows you to use applications that have specifically requested that Harvard's web authentication system also allow XID users to have access.

Secure Connection

To help enhance the protection of personal or confidential information sent to or from the XID system over the Internet, a session is established using Secure Socket Layer (SSL). Any time you supply or access data in the XID system, it is done through a secure connection. The use of SSL requires an SSL-compatible browser on your local machine.

Protecting Logins and Passwords

The XID system provides the means for you to establish a user ID (XID login) and password. When you have finished using the XID system to reset your password or change other information, make sure you click the "Log Out" link on the application. This allows you to end your session, and stop any further transactions from being conducted without requiring the re-entry of your XID and Password. Please be aware that browser software often "caches" a page as you look at it, meaning that some pages are saved in your computer's temporary memory. Therefore, you may find that clicking on your "Back" button shows you a saved version of a previously viewed page. Caching does not affect the security of your XID or Password. But, if you use a computer that is shared with other users to access your XID account information, click logout and quit/exit the browser software before leaving to minimize the possibility of anyone else viewing your information.

Registration Policy

As part of the registration process, you will select a password and an XID login. You also provide registration information. You are prohibited from selecting or using a subscriber ID of another person with the intent to impersonate that person. We also prohibit the use of an XID login ID that Harvard University, in its sole discretion, deems offensive. Failure to comply with the foregoing may result in termination of your account. You shall be responsible for maintaining the confidentiality of your password. Please notify uis_helpdesk@harvard.edu of any known or suspected unauthorized use(s) of your account.