Data Classification Policy

1. Classes

• Public: marketing pages, legal pages.
• Internal: configuration, non-sensitive operational logs.
• Confidential: account data, billing data, communications.
• Restricted: identity documents, financial documents, AI prompts containing restricted content.

2. Handling

Restricted data is stored in the private documents bucket, transmitted only over TLS, accessed only through Row Level Security or admin tooling with audit logging, and never sent to channels (chat, email) without an explicit business need.