Guide: what to expect from a community host #430

Problem

Most groups will start on a community host, a co-op or a friend's server, before they're ready to self-host. The host can read everything in their stack (see #418), so the group's protection is the host's conduct. Nothing tells a group what to ask of a host, or a host what to commit to.

Decision

A short, non-normative guide, outside docs/spec/, describing what a good community host commits to:

• not reading stack contents;
• keeping as few logs as possible, and saying which;
• full-disk encryption;
• a stated policy on legal demands for data;
• notice before shutting down;
• export on request (in Portable export and full-fidelity import #426's format once it exists, a copy of the database and attachments until then).

It describes hosts. It doesn't prescribe anything to groups, and it isn't a certification.

Actions

• The guide, linked from the trust model page (Spec: a trust model page #418) and the README's section on sharing a stack.
• No changeset: docs only.