Changes

Comparing empty → 160dc49.

@@ -1,0 +1,61 @@
1+---
2+title: Data handling
3+sort: 2
4+tags: [policy, compliance]
5+---
6+
7+# Data handling
8+
9+How customer data moves, who can touch it, and what we never do with it.
10+
11+## Classification
12+
13+Every piece of data we handle falls into one of four buckets:
14+
15+| Class | Example | Storage | Access |
16+|-----------------|-----------------------------------------------|----------------------|---------------------------------|
17+| Public | Marketing copy, API spec | Anywhere | Everyone |
18+| Internal | This intranet, OKRs | SSO-gated tools | All employees |
19+| Confidential | Customer email, order data, payment metadata | Tenant region only | Role-gated, audited |
20+| Restricted | PAN, CVV (not stored), employee compensation | Vault, KMS-encrypted | Two-person rule, logged |
21+
22+## What stays in the tenant's region
23+
24+A tenant's `Confidential` data does not leave its home region. There is no cross-region read
25+replica of customer PII. Telemetry that flows centrally is de-identified at source and listed
26+explicitly:
27+
28+- Request counts, latencies, error rates, by route + status
29+- Aggregate billing totals, by tenant id (not by customer id)
30+- Webhook delivery success rates, by endpoint host (not by URL path)
31+
32+What does **not** flow centrally: customer emails, names, addresses, order line items, payment
33+tokens, IP addresses.
34+
35+## Access requests
36+
37+Customer-data access for support requires:
38+
39+1. An open support ticket from the customer's verified contact.
40+2. A manager approval click in the access tool. Approvals expire after 24 hours.
41+3. The query runs against the tenant's region. The audit log captures who, when, what, why.
42+
43+<div class="text-muted">Raw HTML passes through the renderer — this paragraph demonstrates that.</div>
44+
45+## What we never do
46+
47+- Sell, lease, share, or otherwise transmit customer data to third parties for marketing.
48+- Train models on identifiable customer data. (Aggregate, anonymised telemetry is fair game for
49+ internal product analytics.)
50+- Store full card numbers (PAN). Stripe holds the cards; we hold a tokenised handle.
51+
52+## In a breach
53+
54+The first action is the [incident response runbook](incident-response.md). The second is the
55+legal hold and notification — Legal owns this and will direct.
56+
57+## Audits
58+
59+We run a third-party penetration test annually (currently with Trail of Bits) and an internal
60+red-team exercise quarterly. Findings land in the security channel within 30 days of the
61+engagement closing.