ARTICLES OF INCORPORATION OF CIVICOS INSTITUTE

ARTICLE I: NAME

The name of the corporation is CivicOS Institute.

ARTICLE II: DURATION

The period of duration is perpetual.

ARTICLE III: PURPOSE

The corporation is organized exclusively for charitable, educational, and scientific purposes within the meaning of Section 501(c)(3) of the Internal Revenue Code of 1986, as amended. The specific purposes include: (a) Conducting research and development in civic technology, open data systems, and digital public infrastructure; (b) Developing and maintaining open-source software platforms for civic engagement and governance; (c) Educating the public, policymakers, and technologists on best practices in civic technology; (d) Promoting transparency, accountability, and accessibility in democratic institutions; (e) Collaborating with public sector entities, academic institutions, and civil society organizations; (f) Building and supporting communities of practice around civic technology and open government; (g) Publishing research, documentation, and educational materials; (h) Hosting conferences, workshops, and educational events; (i) Providing technical assistance to government entities and nonprofits working in the public interest.

ARTICLE IV: PROHIBITED ACTIVITIES

The corporation shall not: (a) Engage in activities that do not further its exempt purposes; (b) Carry on propaganda or otherwise attempt to influence legislation, except as permitted by Section 501(h); (c) Participate in or intervene in any political campaign on behalf of or in opposition to any candidate for public office; (d) Allow any part of its net earnings to inure to the benefit of any private shareholder or individual; (e) Operate for the benefit of private interests; (f) Discriminate on the basis of race, color, religion, national origin, sex, sexual orientation, gender identity, age, or disability.

ARTICLE V: DISSOLUTION

Upon dissolution, after paying or adequately providing for debts and obligations, the remaining assets shall be distributed to one or more qualifying 501(c)(3) organizations selected by the Board of Directors. Under no circumstances shall any assets be distributed to private individuals or for private benefit.

ARTICLE VI: REGISTERED AGENT

4884 Beresford Circle, West Palm Beach, Florida 33417. Registered Agent: Nicholas A. Cerbone.

ARTICLE VII: INITIAL BOARD

Number of initial directors: 1. Nicholas A. Cerbone, 4884 Beresford Circle, West Palm Beach, Florida 33417.

ARTICLE IX: MEMBERSHIP

The corporation shall have no members. All governance authority is vested in the Board of Directors.

Full certification, signatures, and filing checklist available in the downloadable version below.

Full bylaws document — 13 Articles covering governance, officers, financial controls, conflicts of interest, indemnification, and dissolution. Scroll to read or download below.

ARTICLE I: NAME AND PURPOSE

The Organization is organized exclusively for charitable, educational, and scientific purposes within Section 501(c)(3) of the Internal Revenue Code, including research and development in civic technology, open data systems, digital public infrastructure, and promoting transparency and accountability in democratic institutions.

ARTICLE II: MEMBERSHIP

The Organization shall have no voting members. All governance authority is vested in the Board of Directors.

ARTICLE III: BOARD OF DIRECTORS

The Board shall consist of 3–9 directors. Directors serve 3-year staggered terms, maximum 2 consecutive. Meetings require majority quorum. Action without meeting permitted with unanimous written consent. Directors receive no compensation but may be reimbursed for expenses.

ARTICLE IV: OFFICERS

Officers: Chair of the Board, Secretary, Treasurer, and such others as the Board determines. No individual may hold more than one of Chair, Secretary, or Treasurer simultaneously. Officers elected annually, may be re-elected without term limits.

ARTICLE V: EXECUTIVE DIRECTOR

The Board shall appoint an Executive Director as chief executive officer, responsible for day-to-day operations, implementing Board policy, managing budget and resources, and reporting regularly to the Board.

ARTICLE VI: FINANCIAL ADMINISTRATION

Fiscal year: January 1 – December 31. Annual budget approved by Board before fiscal year start. Annual independent audit required. Dual authorization required for expenditures exceeding established thresholds.

ARTICLE XI: AMENDMENT

These Bylaws may be amended by a two-thirds vote of Directors then in office, provided 7-day notice of the proposed amendment was given.

ARTICLE XII: DISSOLUTION

Dissolution requires three-fourths vote. All remaining assets, after payment of debts, shall be distributed to qualifying 501(c)(3) organizations selected by the Board. No distribution to private individuals.

Full 13-article document with complete provisions available in the downloadable version below.

IRS-required policy for 501(c)(3) organizations. All covered persons sign an annual disclosure statement. Scroll to read or download below.

PURPOSE

This Policy ensures that decisions made by Directors, officers, and key employees are made in the best interest of CivicOS Institute, free from any personal, financial, or other conflicting interests. Compliance is a condition of service.

SECTION 1: DEFINITIONS

A Conflict of Interest exists when a person's personal, financial, professional, or other interests conflict — or appear to conflict — with the interests of the Organization. Conflicts may be actual, potential, or apparent. A Financial Interest includes direct or indirect ownership or investment in entities transacting with the Organization, compensation arrangements, and family member interests.

SECTION 3: DISCLOSURE REQUIREMENTS

Each Director, officer, and key employee must complete and sign the Annual Conflict of Interest Disclosure Statement within 30 days of beginning service and at the start of each fiscal year. Transactional disclosures must be made immediately upon awareness. Gifts over $75 must be disclosed.

SECTION 4: PROCEDURES FOR ADDRESSING CONFLICTS

When a conflict is disclosed: the Interested Person shall leave the meeting during discussion (unless asked to provide information), shall not vote, shall not be counted for quorum on that matter, and shall not attempt to influence the vote outside the meeting. All proceedings related to conflicts shall be documented in minutes.

SECTION 5: PROHIBITED TRANSACTIONS

Without prior Board approval: no loans to Directors, officers, or key employees; no personal guarantees; no sale or purchase of Organization property to/from an Interested Person without competitive process; no compensation arrangements with family members of Directors or officers without open competitive process.

SECTION 7: INVESTIGATION AND ENFORCEMENT

All Directors, officers, and key employees have a duty to report suspected violations. Confirmed violations may result in additional disclosure requirements, suspension, removal from the Board, termination, legal action, or referral to authorities. No retaliation for good-faith reports.

Full policy including annual certification form and disclosure statement template available in the downloadable version below.

Complete authority matrix with signing, spending, personnel, and operational commitment tables. Scroll to read or download below.

AUTHORITY LEVELS

FINANCIAL THRESHOLDS

PROHIBITED ACTIONS

Regardless of authority level, the following are prohibited: self-dealing; splitting transactions to circumvent limits; retroactive approval (except genuine emergencies); conditional commitments without Board indication; personal liability commitments on behalf of the Organization; partisan political activities.

Full matrix including personnel hiring, termination, compensation tables, and signatory card template available in the downloadable version below.

Comprehensive records policy covering all retention categories, electronic storage standards, destruction procedures, and litigation hold protocols. Scroll to read or download below.

RECORDS CLASSIFICATION

LITIGATION HOLD

A hold must be implemented upon receipt of subpoena, threatened litigation, regulatory investigation, or reasonable anticipation of legal action. Normal retention schedules are suspended; all relevant records must be preserved in native format with metadata. Hold released only upon written authorization from designated legal counsel.

SECURE DESTRUCTION

Paper (confidential): Cross-cut shredding minimum DIN P-4 or secure pulping. Hard drives/SSDs: Physical destruction or NIST 800-88 compliant wiping with certificate of destruction. Cloud data: Cryptographic erasure with verification of non-recoverability. Quarterly destruction batch processing with annual certification to Board.

Full policy including electronic storage standards, backup procedures, and privacy protections available in the downloadable version below.

Open-source-first IP policy. Our mission is public benefit — we default to the most permissive appropriate licenses. Scroll to read or download below.

PHILOSOPHY

The Organization is committed to open source principles and supports broad access to its innovations. Our licensing philosophy prioritizes mission advancement over commercial restrictions, adoption and impact through permissive terms, community collaboration through standard licenses, and attribution to recognize contributions.

LICENSE SELECTION — PREFERRED (TIER 1)

CONTRIBUTOR LICENSE AGREEMENTS

All substantial contributions require a signed CLA before acceptance. "Substantial" means code contributions exceeding a de minimis threshold, documentation contributions, design or creative contributions. CLA grants perpetual, worldwide, royalty-free copyright and patent license, with warranty of originality and authority to grant.

COMMERCIAL USE

Commercial use is encouraged and supported. Commercial entities may use Organization software in commercial products, integrate content into commercial offerings, and build consulting businesses around Organization projects — subject to license attribution requirements. The Organization trademarks may not be used without written authorization.

Full policy including third-party code usage requirements, enforcement procedures, and trademark policy available in the downloadable version below.

Comprehensive data, privacy, and security policy. GDPR and CCPA compliant. We hold ourselves to the same standards we advocate for in government systems. Scroll to read or download below.

POLICY PRINCIPLES

Data Minimization: Collect only what is necessary. Purpose Limitation: Use data only for stated purposes. Privacy by Design: Build privacy into systems and processes from the start. Security First: Protect data with appropriate safeguards. Transparency: Be clear about data practices. Individual Rights: Respect and enable data subject rights promptly.

CORE PRIVACY PLEDGE — WE WILL NOT

Sell personal data to third parties. Share data with third parties for their marketing. Use data for purposes beyond those disclosed. Retain data longer than necessary. Collect data from children under 13 without parental consent. Discriminate against individuals exercising privacy rights.

SPECIAL CATEGORIES OF DATA

Racial/ethnic origin, political opinions, religious beliefs, health data, biometric data, and sexual orientation data receive enhanced protection and require explicit consent or substantial public interest basis for processing.

AI DATA HANDLING

Personal data shall not be submitted to external AI models or services without: explicit informed consent from the data subject; a Data Processing Agreement with the AI provider; documentation of the specific purpose and legal basis; and confirmation that the provider does not use submitted data for model training.

BREACH NOTIFICATION

In the event of a data breach: regulatory authorities notified within 72 hours; affected individuals notified without undue delay when breach likely results in high risk; notification includes nature of breach, categories and approximate number of records affected, contact details, and measures taken or proposed.

Full policy including technical controls, third-party processor requirements, data subject rights procedures, and international transfer safeguards available in the downloadable version below.