Zotero AU guidelines

This is not a guide on how to use Zotero (e.g. installation and configuration), it is a guide on how to use Zotero safely, following AU's recommendations on data security.

Introduction and general advice

Zotero is a free, open-source reference management software. It is installed locally by each user (not provided by AU IT). The base system acts as a database of bibliographic information (data and metadata on books, papers, and other types of publications).

The main functionality of the system is local (it remains on your device) and all data and metadata are stored in each user’s system by default. Adding a cloud-sync function is optional, and requires creating an account with at Zotero.org, allowing storing data outside of the user’s system (as an online backup).

The software was developed by an academic institution (Center for History and New Media, George Mason University), and is maintained by a non-profit organisation (Corporation for Digital Scholarship).

Added and optional functions include the ability to sync the database through a cloud storage, web browser integration through browser add-ons, PDF storage with annotation capabilities, notes, the possibility to create a personal account, and word processor integration (Microsoft Office, Libreoffice writer, and Google docs) through plug-ins.

• The software should be used it as it is intended (for storing public bibliography information, and not e.g. private information).
• You should not store personal files, or any files containing personal or sensitive information. This is a requirement of use within AU, to minimise the possibility of data misuse in a worst-case scenario.
• If you choose to synchronise, and thus, create a Zotero account, be aware that your name, email, address and metadata will be stored in Zotero servers outside of the EU, for functionality purposes only, and never shared with 3rd parties.
• Zotero anonymises and aggregates synchronised user and group library data to generate statistics on readership (this only includes publicly available metadata, e.g. publication title and author. This data is never sold or made available in any forms other than ones offered publicly.

Synchronisation and local backups

You can create a Zotero account to synchronise your collection (i.e. have a cloud-based backup). This requires having a Zotero account. When synchronising, a copy of your data will be stored on Zotero servers, which means all of your data will be backed-up. However, synchronisation is optional.

"Unlike many cloud-based tools, the Zotero desktop application is a local program that runs on your computer and saves all research data locally by default. Unless you explicitly set up syncing, your research data never leaves your computer" (https://www.zotero.org/support/security, accessed 14 jan 2024)

If you decide to not synchronise, it is strongly advised to regularly back up your Zotero library. For this you will have to:

1. Find your Zotero data directory (it should be a folder in your computer)
2. Close Zotero on your desktop before step 3
3. Copy this folder and paste it to another location of your choice, that is not your computer (e.g. a USB drive or external disk)

(you can find steps to restore your data from a local backup here).

Using Zotero Connector

When installing the Zotero Connector (to add items to your Zotero library through the browser), your browser will warn you that the extension can “Read and change all your data on the websites you visit” (or similar). This is the standard permission that browser extensions, that run on all pages, require.

Zotero uses it to determine what content it can save on a given page and update the save button accordingly, as well as to provide advanced features such as automatic proxy redirection and automatic RIS/BibTeX import. No data is stored except when you choose to save a page to either your local or online Zotero library.

Using the Zotero plug-in for word and libreoffice

Zotero includes a plug-in to add references to your documents (in Word and Libreoffice).

You may need permission to correctly install and use this plug-in on AU systems. Contact your local IT department, and ask them to add your user to the "GPO group M365Apps-Allow-UI-Extending".

Exporting data

You can export your Zotero library if you want to "move" to another bibliography manager software (e.g. Mendeley).

To export an entire library, right-click on it in the Zotero collections pane and choose “Export Library…”, or select “Export Library…” from the “File” menu. To export an individual collection, right-click on it and choose “Export Collection…”. To export specific items, select them in the items list, right-click, and choose “Export Items…”. It is recommended to export in the RIS format. RIS is a standard citation format shared by EndNote, Mendeley, and Zotero.

Third-Party Services

(This section only applies to synchronised accounts)

All Zotero server data is stored in the United States in Amazon Web Services. See Security of Zotero Data for more information.

Certain operations you perform in Zotero may trigger requests to public third-party services such as Crossref or the Library of Congress for metadata retrieval. These third parties may log your IP address and search terms (e.g., DOI or ISBN) according to their privacy policies, but no other identifying information is provided.

Zotero logs requests made to its server, including IP addresses and client information, in order to prevent abuse, diagnose technical issues, and assess usage. Zotero retain these logs for up to 90 days. You can opt out of all requests to Zotero servers.