Skip to content

Data Classification & Handling Policy

Field Value
Status draft
Owner DIR
Applies to All Partile data — user data, event/ML data, security data, governance evidence — wherever it lives (Postgres, Redis, Git, vendor systems, the restricted store).
Review cadence Annual, or when a new data class or store is introduced.
Mapped controls PRIV-06 (minimization), SEC-05/06 (secret + intake hygiene), ML-04 (no content/secrets in events).
Evidence readiness/data-inventory-and-retention.md (field-level data map); evidence/evidence-register.md; this data room's two-tier rule.
Exception handling Any move of data to a lower-protection store is a dated DIR decision; Tier-2 material never moves to Git.

Purpose

Define Partile's data classes and the handling rule for each — the basis of the data room's two-tier model and of what may ever appear in Git.

Classification

Class Examples (Partile) Handling
Restricted (Tier 2) Real DSAR/erasure contents, real incident records with PII, signed DPAs, raw pentest exploit detail, entity/contact/vendor-account details, counsel-private advice Never in Git. Restricted store only. Git points to it by reference.
Confidential / Secret Credentials, API keys, session tokens, OAuth codes, .env values, full cloud resource identifiers where sensitive, signed/token-bearing URLs Never in code, logs, or this repo. Env/Secret Manager/operator secret stores only (cryptography-and-secrets-policy.md).
Personal data LinkedIn sub/email/name/picture; presence (airport/gate/time); match pairs; message bodies; blocks/reports Minimize, retain per schedule, handle per privacy policy. Proximity data is personal even without a name (re-identification).
Internal / governance (Tier 1) Control register, registers, policies, procedures, threat model, design docs Git-safe. No secrets/PII. This data room.
Public Already-public project context No restriction.

Handling rules

  1. Minimize by construction. Collect/retain only what the feature needs. No raw boarding-pass artifacts; only derived presence fields (PRIV-06, SEC-06).
  2. No secrets or PII in Git or this data room. Safe labels (DATABASE_URL) yes; values no. Enforced by the release-review rg scan.
  3. No content or identity in events. ML/analytics events carry length not body, internal UUID not email/sub (ML-04). See ai-ml-data-governance-policy.md.
  4. Pointer-only registers. dsar-log.md and incident-log.md hold process + non-identifying index only; instances are Tier 2.
  5. Encryption. Personal/confidential data is encrypted on public transit paths (TLS), isolated on private GCP data paths, and encrypted at rest in managed production stores/backups (cryptography-and-secrets-policy.md).
  6. Disposal. Data is deleted per privacy-and-retention-policy.md and the retention schedule; deletion is real (hard-delete spine), not just a flag.

When in doubt

Default to the more protective class. If unsure whether something is Tier 2, it is Tier 2 — keep it out of Git until reclassified by a DIR decision.

Exceptions

Reclassifying data downward (more exposure) is a dated DIR decision with rationale, recorded in the READINESS.md decision log. There is no exception that allows secrets or real PII into this repository.