# Data Classification Policy

**Touch2Sign Ltd**  
**Version:** 1.0  
**Effective date:** 11 July 2026  
**Owner:** Robert — Security Lead  
**Approved by:** Robert — CEO / Managing Director  
**Next review:** 11 July 2027

---

## 1. Purpose

Define classification levels for information processed by Touch2Sign and minimum handling requirements for each level. Enables consistent protection of customer documents, personal data, and internal assets.

## 2. Scope

Applies to all information in any form:

- Electronic records (database, S3, logs, email)  
- Paper records (contracts, printed support tickets)  
- Verbal disclosure in meetings or support calls  

## 3. Classification levels

| Level | Description | Examples |
|-------|-------------|----------|
| **Public** | Approved for public disclosure | Marketing website, public pricing, published blog posts, open-source snippets |
| **Internal** | Touch2Sign business use; not for external release | Internal runbooks, source code, sprint plans, non-customer Slack channels |
| **Confidential** | Sensitive business or customer data | Customer documents (PDFs), signing audit trails, org settings, support tickets with customer context, aggregated analytics |
| **Restricted** | Highest sensitivity; severe impact if disclosed | IDV results (OneID, eID Easy), database credentials, Secrets Manager values, signing keys, break-glass credentials, full production DB exports |

When in doubt, classify **up** one level until confirmed with Security Lead or DPO.

## 4. Handling requirements

| Control | Public | Internal | Confidential | Restricted |
|---------|--------|----------|--------------|------------|
| Encryption at rest | Optional | Recommended | **Required** (AES-256) | **Required** (KMS) |
| Encryption in transit | TLS for web | TLS | **TLS 1.2+** | **TLS 1.2+** |
| Access control | None | Staff authentication | Role-based; logged | Least privilege; MFA; logged |
| Storage location | Public CDN | Approved systems only | AWS eu-west-1 production | Secrets Manager / RDS only |
| Email transmission | Allowed | Internal email OK | Encrypted or secure portal preferred | **Prohibited** — use secure channel |
| Printing | Allowed | Shred when done | Shred when done; clean desk | **Avoid print** |
| External sharing | Allowed | NDA for contractors | Customer DPA / contract only | Prohibited except legal requirement |
| Retention | Per comms plan | 3 years default | Per Data Retention Policy | Rotate / delete when unused |
| Disposal | Delete | Secure delete | Secure delete + audit | Crypto-shred keys; cert of deletion |

## 5. Customer document data

Customer-uploaded documents and signed artifacts are **Confidential** minimum. They may contain **Restricted** data if they include ID documents or special category data — customers are responsible for content classification; Touch2Sign applies highest controls regardless.

Handling rules:

- Stored encrypted in S3 (eu-west-1)  
- Access via application authorisation only — no direct bucket browsing  
- Support access logged in ticket and audit systems  
- Not used for AI training; Anthropic Q&A minimises content per DPIA  

## 6. Personal data mapping

| Data element | Typical classification |
|--------------|------------------------|
| Signer name, email | Confidential |
| IP address, user agent (audit) | Confidential |
| IDV verification result | Restricted |
| Payment card data | Restricted — handled by Stripe (PCI scope) |
| Hashed document integrity values | Confidential |
| Cognito password | Restricted — never accessible to Touch2Sign staff |

## 7. Labelling and marking

- Internal documents: footer "Touch2Sign Internal" where practical  
- Confidential exports: filename prefix or ticket reference  
- Restricted data: never exported to local laptops without CEO + Security Lead approval and encryption  
- Email subject lines must not contain Restricted content or full document titles with PII  

## 8. Roles

| Role | Responsibility |
|------|----------------|
| **All staff** | Classify data they create or handle; follow handling table |
| **Engineering** | Implement technical controls per classification |
| **Support** | Minimum necessary access; Confidential handling in tickets |
| **DPO** | Advise on personal data and special category data |
| **Security Lead** | Policy enforcement; exceptions |

## 9. Exceptions

Exceptions to handling requirements require documented risk acceptance approved by Security Lead (Restricted: also CEO). Maximum exception period **90 days**.

## 10. Related documents

- Information Security Policy  
- Data Retention & Disposal Policy  
- Acceptable Use Policy  
- Cryptography & Key Management Policy  

## 11. Review

Reviewed **annually** and when new data types or processing activities are introduced.

---

**Approval**

| Name | Role | Signature | Date |
|------|------|-----------|------|
| Robert | CEO / Security Lead | Electronic | 11 July 2026 |