Effective Date: August 15, 2026
1. PURPOSE
The purpose of this Data Classification Statement is to define how the Company identifies, categorizes, handles, and protects information processed within the Service. Data classification enables the Company to apply appropriate technical and organizational safeguards based on the sensitivity, confidentiality, and operational impact of the data. This framework supports security governance, regulatory compliance, and risk management practices.
2. SCOPE
This policy applies to all data generated, processed, stored, or transmitted by the Service, including:
Customer Data processed by the Service.
Company Operational Data (internal business information).
System-Generated Data (logs, telemetry, metadata).
Employee and Contractor Information.
Data handled by approved Subprocessors.
All personnel, contractors, and authorized users are expected to follow this classification model when creating, accessing, storing, or transmitting information.
3. CLASSIFICATION MODEL
The Company classifies data into four sensitivity tiers.
3.1. General Rule.
All data processed by the Service must be assigned a classification level at the time of creation or ingestion. If classification is unclear, the data defaults to the higher sensitivity level (e.g., Confidential) until formally reviewed.
3.2. Level 1: Public Data
Definition: Information approved for public disclosure with no expected negative impact if released.
Examples: Marketing materials, Public documentation, Published product information, Public API specifications, Press releases.
Protection Requirements:
Access: Open to the public.
Control: Integrity must be maintained (prevention of defacement), but confidentiality controls are not required.
3.3. Level 2: Internal Data
Definition: Non-public information intended for internal operational use. Unauthorized disclosure could cause minor operational, reputational, or competitive impact.
Examples: Internal procedures, Product roadmaps, Non-sensitive business communications, Aggregated operational metrics, Employee handbooks.
Protection Requirements:
Access: Limited to authorized personnel (Employees/Contractors).
Storage: Stored within Company-approved collaboration and document management systems.
Transmission: Protected via standard transport encryption (TLS).
Authentication: Single Sign-On (SSO) or standard password authentication required.
3.4. Level 3: Confidential Data (Default for Customer Data)
Definition: Sensitive information requiring strong protection against unauthorized access or disclosure. Exposure could result in significant operational, financial, legal, or reputational harm.
Examples: Customer Content, Customer Account Data, Source Code, Non-Public Intellectual Property, Vendor Agreements, Security Vulnerability Reports.
Protection Requirements:
Encryption: Must be encrypted in transit (TLS 1.2+) and at rest (AES-256).
Access: Governed by Least Privilege and Role-Based Access Control (RBAC).
Authentication: Strong authentication (MFA) required for administrative access.
Logging: Access and modification activity must be logged.
NDA: Third-party access requires a Non-Disclosure Agreement.
3.5. Level 4: Restricted Data (Critical)
Definition: Highly sensitive data requiring the highest level of protection. Unauthorized exposure could result in severe legal liability, regulatory penalties, or material security risk.
Examples: Production Database Credentials, Cryptographic Secrets/Private Keys, MFA Seeds, Government-Issued Identifiers (where applicable), Payment Card Data (PCI), Incident Investigation Materials.
Protection Requirements:
Minimization: Data collection follows the principle of data minimization—Restricted data is collected and processed only when strictly necessary for defined business purposes.
Encryption: Mandatory strong encryption at rest and in transit.
Access: Strictly limited to specific roles (e.g., DevOps Lead, CISO) with Just-In-Time (JIT) access where feasible.
Monitoring: Enhanced monitoring and alerting on access.
Storage: Limited to approved secure systems (e.g., Secrets Manager, Vault). Never stored in local files, email, or chat.
Device: May only be accessed from managed, secure devices.
4. CUSTOMER DATA CLASSIFICATION
4.1. Default Status.
Customer Data is classified as Level 3 (Confidential) by default. This ensures that all customer information receives strong encryption, access control, and logging protections automatically.
4.2. Customer Responsibility.
Customers are responsible for determining the sensitivity of the data they upload to the Service and for configuring access controls appropriately within their environments. The Company does not require Customers to submit Level 4 (Restricted) data unless explicitly supported by specific features of the Service. Customers are responsible for ensuring that the data they upload is appropriate for the Service and complies with applicable laws and regulations.
5. DATA OWNERSHIP & RESPONSIBILITY
Ownership: Customers retain ownership of their data.
Processor Role: The Company acts as a data processor/service provider and handles Customer Data strictly in accordance with contractual obligations (DPA) and applicable data protection laws.
Internal Responsibility: Internal data owners are responsible for ensuring that data is appropriately classified and handled according to this policy.
6. DATA HANDLING PRINCIPLES
The Company applies the following principles across all classification tiers, scaling controls proportionally with data sensitivity:
Least Privilege Access: Users only access data necessary for their role.
Need-to-Know Basis: Access is granted based on specific business justification.
Secure Transmission: Higher classifications require secure transfer protocols.
Lifecycle Management: Data is retained only for as long as necessary.
7. DATA LIFECYCLE ALIGNMENT
Data classification informs controls across the full data lifecycle, including Creation, Storage, Usage, Sharing, Archival, and Deletion. Specific retention periods and disposal methods are defined separately within the Data Retention & Deletion Policy (Document 5.7).
8. THIRD-PARTY PROCESSING
Subprocessors that may access classified data (Level 3 or Level 4) are required to implement security controls appropriate to the sensitivity level of the information processed. Vendor risk assessments are conducted prior to authorization. Details are maintained in the Subprocessors (Document 5.6) section of the Trust Center.
9. POLICY GOVERNANCE
This statement is reviewed periodically and updated to reflect changes in regulatory requirements, threat landscapes, and operational practices. Exceptions to this policy must be formally approved through internal risk acceptance procedures. Compliance with this policy may be validated through periodic internal reviews and security audits.
10. RELATIONSHIP TO SECURITY PROGRAM
This Data Classification Statement operates as a supporting control within the Company’s broader information security program and should be read in conjunction with the Security Overview (Document 5.1) and related Trust Center documentation.