Account and Security FAQ’s
My name is incorrect on my profile, preprint, registration or OSF project, How can I fix it?
On preprints, registrations, or OSF projects your name on the by-line or citations is controlled by the information on your OSF profile ( https://osf.io/profile/) to edit your profile information use this help guide: https://help.osf.io/article/242-edit-your-profile
My account has been deactivated or flagged as Spam, What do I do?
We investigate reported cases of OSF users being accidentally flagged or deactivated on a case-by-case base. If you have an account or material that has been flagged as SPAM or deactivated please report your case here. Cases are reviewed within 48 to 72 hours. To Report a case of OSF users being accidentally flagged or deactivated please fill out the form on this page: https://help.osf.io/article/411-spam-deactivation
I'm trying to verify my account but am not receiving the email. What should I do?
Try checking your spam and quarantine folders to see if the email was sent there. If you still don't find it, please submit a request to user support, and we will help you. Contact our support team using the support center beacon found on the bottom right side of any OSF support page:
My email address has changed. How do I change my login email?
From your " Account Settings" page, you can add additional email addresses to your account, and select which of these is your primary email address. Any of these emails can be used to log in to OSF.
I have multiple OSF accounts. How do I merge them into one account?
Log in to the account you wish to keep and navigate to your " Account Settings" page. There, enter the email address associated with your other OSF account. You will receive a confirmation link via email. Clicking the link will merge the projects and components into one account. For more information see our help guide on merging your account
How do I deactivate my OSF account?
From your " Account Settings" page, you can request a deactivation of your OSF account. A member of the OSF team will review your request and respond to confirm deactivation. Here is a help guide to help you deactivate your account
How can I receive activity points on my OSF profile?
Activity points are added the more you use the OSF. So the more projects, preprints, and registrations you create the more points you will accumulate.
What types of data does OSF collect?
Can I have my data deleted?
You’re always welcome to deactivate or delete your account. To deactivate your account use this help guide, If you’d like to delete your account and personal data, please contact our support team using the support center beacon found on the bottom right side of any OSF support page:
What steps has OSF taken to comply with GDPR?
Can I opt out of having my data collected?
You’re always welcome to deactivate or delete your account. You should be aware that information that you've shared with others or that others have copied may also remain visible after you have closed your account or deleted the information from your own profile. In addition, you may not be able to access, correct, or eliminate any information about you that other users have copied or exported out of the Websites, because this information may not be in our organization's control. Your public profile may be displayed in search engine results.
How can I export my data?
You can export your project files in .zip format, one for each storage provider. You can also access all the content of your projects via the OSF's open API; documentation is available at developer.osf.io
What if I don't want to make anything available publicly in the OSF?
The OSF is designed to support both private and public workflows. You can keep projects, or individual components of projects, private so that only your project collaborators have access to them. Registrations can be made private (Embargoed) for up to 4 years. After that time the registration will be made public. While Preprints are made publicly available upon submission, unless submitted to a preprint community service.
How secure is my information?
Security is extremely important for OSF. When you sign up and create a password, your password is not recorded. Instead, we store a bcrypt hash of your password. This is a computation on your password that cannot be reversed but is the same every time it is computed from your password. This provides extra security. No one but you can know your password. When you click "Forgot your password," OSF sends you a new random password because it neither stores nor has the ability to compute your password. For more information see our Secutiry and Privacy help guides
Is data stored on OSF Storage encrypted? What are my options?
Transfer of data to OSF storage is encrypted with TLS and is encrypted at rest with Google-managed Encryption Keys( https://cloud.google.com/storage/docs/encryption/default-keys). If you would like your data to be encrypted at rest with your own self generated key, you can encrypt it before uploading to OSF Storage.
How do I report a potential security issue?
If you would like to report a security issue, please contact our support team for instructions on how to report the security issue. Do not include details of the issue in that email. Contact our support team using the support center beacon found on the bottom right side of any OSF support page:
How does OSF store and backup files that I upload to the site?
For OSF Storage, files are stored in multiple locations and on multiple media types on Google Cloud. We keep three types of hashes (MD5, SHA-1, SHA-256) for files. We keep parity archive files to recover from up to 5% bit error.
The OSF database is backed up via streaming replication 24 hours a day, and incremental restore points are made twice daily. Further, the OSF database is maintained in encrypted snapshots for an additional 60 days. Database backups are verified monthly.
Operational data (e.g., config files) for other OSF services are backed up in primary cloud file storage for 60 days.
Logs are primarily stored in Google Cloud cold storage indefinitely. In certain cases a third party aggregation service is used for up to 90 days.
If I delete a file or project, can I get them back?
Unfortunately, no. When a user deletes a file or project from OSF, access to this content is removed for all users.
What if I don't want to make anything available publicly in OSF?
OSF is designed to support both private and public workflows. You can keep projects, or individual components of projects, private so that only your project collaborators have access to them.
Is OSF HIPAA compliant?
OSF is not HIPAA compliant. If you use a HIPAA-compliant storage provider that is available as an OSF add-on, we recommend using that service connected to your OSF project to meet your HIPAA requirements. Please refer to your institutional policies regarding specific security requirements for your research.
I found content on OSF that I believe infringes on my copyright. What should I do?
Where can I check if OSF experiences downtime, or is “temporarily broken”?
If you experience problems using OSF or connecting to one of the third-party storage add-ons, you can check our status page for updates on how our services are operating.