Data Classification & Retention Policy

Owner	[Security Owner — to be named: founder/CTO]
Approved by	[signatory]
Effective date	[set on approval]
Review cadence	Annual
Version	0.1 — DRAFT
TSC mapping	C1 (Confidentiality), CC6.7

1. Purpose

Define how Company and customer data is classified, protected, retained, and disposed of.

2. Data classes

Class	Examples	Handling
Restricted	Customer PII, purchase orders, ERP credentials	Encrypted at rest & in transit; tenant-isolated; least-privilege access; audited support access
Confidential	Internal docs, source code, configuration	Access-controlled (GitHub, Google Workspace); secrets excluded
Secrets	API keys, tokens, ERP credentials	Stored in Infisical / 1Password only; never committed or logged
Public	Marketing site, public docs	No restriction

3. Encryption

• In transit: TLS everywhere; internal admin surfaces sit behind Cloudflare Access.
• At rest: ERP credentials are encrypted with AES-256-GCM using keys derived via PBKDF2-HMAC-SHA512; object storage (R2) uses server-side encryption; the database is encrypted at rest by the provider.

4. Cardholder data (PCI scope)

The Company does not store cardholder data. Primary account numbers and CVV values are scrubbed at ingestion (the WhereFour PAN/CVV scrub, CASA 6.5.1); this scrub is the control that keeps cardholder data out of scope. Billing card data is handled solely by Stripe.

5. Retention

Retention is enforced in the data model via retention classes:

• retain_30d — transient/operational data is retained 30 days, then eligible for deletion.
• keep_forever — records of account (e.g. order history required for customer operations) are retained for the life of the relationship.
• retain_90d_unadjudicated — calibration corpora containing Restricted data (currently jev_decision_snapshots, the event-time record of what the Jev validator scored) are deleted 90 days after capture unless a named data owner has adjudicated the row; adjudicated rows are the calibration gold set and are retained. Enforced weekly by the Dagster jev_snapshot_retention job. Adjudicators read through the jev_adjudication_reader role, which RLS scopes to one organization at a time. The table owner (the role the validator writes and the retention job deletes as) is exempt from RLS, because RLS is enabled but not forced; access to that role is the remaining control.

Retention classes are reviewed annually and adjusted to match contractual and legal requirements.

6. Disposal

Data past its retention period is deleted from primary stores; object-storage versions and database backups age out per provider retention. On customer offboarding, the Company deletes or returns customer data per the contract and records the disposal.

7. Review

Reviewed at least annually by the Security Owner.