GT-IoTEdu · Official document
Terms of Use
This document sets forth the conditions for use of the IoTEdu service: who may access it, how institutions join, what the responsibilities of each party are, and which conduct is prohibited.
1 Introduction
IoTEdu is a service for the registration, inventory, monitoring, and protection of Internet of Things devices on academic networks. Through it, members of the academic community register the equipment they use on the institution's network, and the information technology team maintains an inventory of that equipment, identifies the person responsible for each item, and tracks the associated security events.
These Terms of Use govern the use of the reference instance of the service, available at app-unipampa.iotedu.org. This instance is provided by Fundação Universidade Federal do Pampa (UNIPAMPA), registered with the CNPJ/MF (Brazilian National Registry of Legal Entities) under No. 09.341.233/0001-22, within the scope of GT-IoTEdu, an RNP Working Group supported by Rede Nacional de Ensino e Pesquisa (RNP, Brazil's National Research and Education Network).
By accessing the service with your institutional identity, you represent that you have read and agree to these Terms of Use and to the Privacy Policy.
IoTEdu is software installed on the infrastructure of each adopting institution. When another institution begins operating its own instance, that institution is responsible for providing that service and for its own terms of use.
2 Terms and definitions
| CAFe | Comunidade Acadêmica Federada (Federated Academic Community), RNP's identity management service that brings together teaching, research, and innovation institutions in Brazil. |
|---|---|
| Participating institution | An institution that has joined the IoTEdu deployment program and whose network is managed through the service. |
| Unit | A campus, department, laboratory, or other institutional subdivision with which devices and administrators are associated. |
| Institutional superuser | An account with administrative privileges over the entire institution, including the definition of global parameters, units, and policies. |
| Unit administrator | An account with administrative privileges restricted to a single unit, responsible for that unit's devices and security events. |
| User | A member of the academic community who accesses the service to register and track their own devices. |
| Device | An Internet of Things item of equipment registered on the platform, such as a sensor, camera, controller, or laboratory equipment. |
| Person responsible for the device | The user who registers the device and to whom it is linked in the institution's inventory. |
| Detection probes | Traffic monitoring components used by the platform (Suricata, Snort, and Zeek). |
| Security incident | Any confirmed or suspected adverse event related to the security of computer systems or networks. |
3 Contact
| IoTEdu service | iotedu@unipampa.edu.br |
|---|---|
| Service manager |
Diego Kreutz, GT-IoTEdu coordinator diegokreutz@unipampa.edu.br |
| Personal data protection |
UNIPAMPA Data Protection Officer (Encarregado pelo Tratamento de Dados Pessoais):
encarregado.lgpd@unipampa.edu.br sites.unipampa.edu.br/lgpd/contato-encarregado |
| Project website | iotedu.org |
4 Who may access IoTEdu
Access to the service is provided through the CAFe Federation, using the identity issued by the user's home institution. The service does not create its own passwords for federated users and does not perform authentication: authentication is performed by the home institution.
Effective use of the service requires that the user's institution be a participating institution. The platform operates on the institution's own network, so that, absent a deployment, there is no environment to be managed. Authentication alone does not mean that the service is available.
Institutional credentials are personal and non-transferable, and their disclosure to third parties is prohibited.
IoTEdu is not directed at children, as defined in the Estatuto da Criança e do Adolescente (Lei nº 8.069/1990, Brazil's Statute of Children and Adolescents).
5 Institutional enrollment
An institution wishing to use IoTEdu must express its interest through the channels listed in Section 3. Enrollment comprises the following stages:
- expression of interest to the GT-IoTEdu coordination;
- internal approval and provisioning, by the institution, of the network prerequisites: a dedicated VLAN and SSID, a server with two network interfaces, and an IP address range;
- deployment of the platform, carried out by the institution's local team with remote support from the Working Group;
- assisted operation with a small group of users and low-criticality devices;
- progressive migration of the remaining devices, staff training, and assumption of day-to-day operation by the institution.
Upon enrollment, the institution designates the institutional superuser responsible for configuring the service and for appointing the unit administrators.
An institution that chooses to operate its own IoTEdu instance must register the corresponding service provider with CAFe, using its own domain and certificate.
6 Device registration
An authenticated user may register devices by providing their identification and purpose. Registration links the device to the user, who is then listed as the person responsible for it in the institution's inventory.
Depending on the configuration adopted by the institution, the device may enter into operation immediately or remain pending approval by the unit administrator.
The user may view, correct the information on, and remove from their registration the devices under their responsibility.
7 Monitoring and blocking
By registering a device, the user acknowledges that it will be included in the institution's inventory, assigned to the network segment corresponding to its classification, and continuously monitored with respect to its network behavior.
The device's network access may be automatically blocked by the platform in response to a high-severity security event, or blocked by decision of the unit administrator. In either case, the person responsible is notified and may request a review, as set forth in Section 9 of the Privacy Policy.
Monitoring covers the network segment dedicated to Internet of Things devices. The records generated describe the network behavior of the equipment, and their processing is described in the Privacy Policy.
8 Responsibilities of institutions
In order to use IoTEdu, the participating institution is responsible for:
- providing and maintaining the network prerequisites and the infrastructure on which the platform runs;
- providing accurate and truthful information about the designated administrators, and assuming responsibility for the content of such information;
- defining the institutional policy governing the admission of devices to the network, as well as the approval and blocking rules;
- keeping the designations of the institutional superuser and of the unit administrators up to date;
- reporting to GT-IoTEdu any vulnerabilities or security events involving the service;
- complying with the legislation applicable to the processing of the personal data under its responsibility.
9 Responsibilities of administrators
In administering the service, institutional superusers and unit administrators are responsible for:
- configuring units, address ranges, and service parameters within their respective scope;
- approving, blocking, and unblocking devices, recording the reason for each decision;
- handling the security events referred for human triage;
- reviewing the requests for review of blocking decisions submitted by the persons responsible;
- enabling and disabling user accounts within their respective scope;
- using the information to which they have access exclusively for network management and security.
10 Responsibilities of users
By registering a device, the user declares that they are responsible for it before the institution, which includes:
- providing truthful information about the equipment and its purpose;
- registering only devices that they actually use or administer, and not registering devices on behalf of third parties without authorization;
- keeping the equipment in a reasonable state of security, applying firmware updates when available and replacing factory default passwords;
- keeping the registration up to date and removing devices that are no longer in use;
- being accountable for actions originating from the device on the network.
11 Responsibilities of GT-IoTEdu
GT-IoTEdu is responsible for developing and maintaining the software, for providing remote support for deployment and operation at participating institutions, and for operating the reference instance.
Defining the institutional policy for device admission, deciding on approvals and blocks, and the day-to-day operation of the network are the responsibility of the participating institution. GT-IoTEdu shall not be liable for the conduct of institutions, administrators, or users in their use of the service, nor for the content they record on the platform.
The security monitoring offered by the platform is an additional layer of protection. It does not replace the institution's security controls and does not eliminate the risk of incidents. Responsibility for the security of each device remains with whoever operates it.
12 Acceptable use of the service
The following conduct is prohibited in the use of IoTEdu:
- using the service for any purpose unrelated to teaching, research, innovation, or management of the institutional network;
- registering false information about devices or their purpose;
- obtaining or attempting to obtain unauthorized access to systems, data, or other users' accounts;
- performing scans, attacks, or any interference with the operation of the network or the platform;
- circumventing the service's security controls, including attempting to reconnect a blocked device to the network;
- collecting information about other users or processing such information in any manner that does not comply with the LGPD;
- producing or transmitting data in violation of Brazilian law;
- making commercial use of the service or of any content contained in it.
A user's or device's access may be suspended at any time in the event of a breach of these terms, of use that compromises the security or availability of the network, or at the direction of the home institution. Whenever possible, the user will be notified before the suspension takes effect.
13 Costs
The service is provided free of charge during Phase 2 of GT-IoTEdu. There is no subscription, monthly fee, per-device or per-user licensing, or paywalled area.
The model for sustaining the service after the Working Group concludes is still being defined. Any change to the conditions above will be communicated in advance to users, participating institutions, and CAFe.
14 Intellectual property
IoTEdu is open-source software. The intended license for the code developed by the Working Group is Apache-2.0, subject to ratification through RNP's intellectual property and governance process, and third-party components are governed by their respective licenses. The project's public repositories are available at github.com/GT-IoTEdu.
The project's name, trademark, domain, and visual identity are not transferred by this document, and their use requires prior authorization from the GT-IoTEdu coordination.
15 Service availability
The reference instance is provided "as is," in the context of a research pilot. There is no guarantee of uninterrupted availability, absence of failures, or full preservation of data in the event of incidents, and there is no service level agreement.
The service may be suspended for maintenance, have its features modified, or be discontinued at the end of the Working Group. In such cases, reasonable prior notice will be given to users and participating institutions.
16 Revision history
These Terms of Use may be modified or updated at any time, with publication on this same page and an update of the version and date. Material changes will be communicated to users and participating institutions.
This document was last updated on September 23, 2026, and takes effect immediately upon publication.
These Terms are governed by Brazilian law, in particular Lei nº 13.709/2018 (LGPD) and Lei nº 12.965/2014 (Marco Civil da Internet).