Skip to main content
Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: In progress This policy defines data classification levels and handling requirements used across product and operations.

What this policy answers

  • Which classification levels are used
  • What baseline handling controls apply to each level
  • What is already operating versus still being formalized

Current state (as of March 5, 2026)

Classification controls are active operationally. Policy formalization and evidence mapping are being finalized as part of the SOC 2 workstream.

Classification levels

LevelExamplesHandling baseline
PublicPublic documentation and published materialsNo confidentiality restrictions
InternalOperational runbooks and internal non-sensitive recordsInternal access controls
ConfidentialCustomer configuration and operational metadataLeast privilege and encrypted storage and transport
SensitiveCredentials, security artifacts, regulated identifiers where presentRestricted access, strict storage controls, heightened monitoring

Handling controls currently enforced

  • Access by least privilege and role scope
  • Encryption in transit and at rest
  • Secrets in managed secret systems
  • Retention and deletion per policy expectations

In progress

  • Final policy language and control-to-evidence mapping completion target: March 2026.

Exceptions and governance

Classification exceptions require documented risk, approval, and a time-bound remediation plan. Questions: