Data Classification Policy

Touch2Sign Ltd

Version: 1.0

Effective date: 11 July 2026

Owner: Robert — Security Lead

Approved by: Robert — CEO / Managing Director

Next review: 11 July 2027

---

1. Purpose

Define classification levels for information processed by Touch2Sign and minimum handling requirements for each level. Enables consistent protection of customer documents, personal data, and internal assets.

2. Scope

Applies to all information in any form:

• Electronic records (database, S3, logs, email)
• Paper records (contracts, printed support tickets)
• Verbal disclosure in meetings or support calls

3. Classification levels

Level	Description	Examples
Public	Approved for public disclosure	Marketing website, public pricing, published blog posts, open-source snippets
Internal	Touch2Sign business use; not for external release	Internal runbooks, source code, sprint plans, non-customer Slack channels
Confidential	Sensitive business or customer data	Customer documents (PDFs), signing audit trails, org settings, support tickets with customer context, aggregated analytics
Restricted	Highest sensitivity; severe impact if disclosed	IDV results (OneID, eID Easy), database credentials, Secrets Manager values, signing keys, break-glass credentials, full production DB exports

When in doubt, classify up one level until confirmed with Security Lead or DPO.

4. Handling requirements

Control	Public	Internal	Confidential	Restricted
Encryption at rest	Optional	Recommended	Required (AES-256)	Required (KMS)
Encryption in transit	TLS for web	TLS	TLS 1.2+	TLS 1.2+
Access control	None	Staff authentication	Role-based; logged	Least privilege; MFA; logged
Storage location	Public CDN	Approved systems only	AWS eu-west-1 production	Secrets Manager / RDS only
Email transmission	Allowed	Internal email OK	Encrypted or secure portal preferred	Prohibited — use secure channel
Printing	Allowed	Shred when done	Shred when done; clean desk	Avoid print
External sharing	Allowed	NDA for contractors	Customer DPA / contract only	Prohibited except legal requirement
Retention	Per comms plan	3 years default	Per Data Retention Policy	Rotate / delete when unused
Disposal	Delete	Secure delete	Secure delete + audit	Crypto-shred keys; cert of deletion

5. Customer document data

Customer-uploaded documents and signed artifacts are Confidential minimum. They may contain Restricted data if they include ID documents or special category data — customers are responsible for content classification; Touch2Sign applies highest controls regardless.

Handling rules:

• Stored encrypted in S3 (eu-west-1)
• Access via application authorisation only — no direct bucket browsing
• Support access logged in ticket and audit systems
• Not used for AI training; Anthropic Q&A minimises content per DPIA

6. Personal data mapping

Data element	Typical classification
Signer name, email	Confidential
IP address, user agent (audit)	Confidential
IDV verification result	Restricted
Payment card data	Restricted — handled by Stripe (PCI scope)
Hashed document integrity values	Confidential
Cognito password	Restricted — never accessible to Touch2Sign staff

7. Labelling and marking

• Internal documents: footer "Touch2Sign Internal" where practical
• Confidential exports: filename prefix or ticket reference
• Restricted data: never exported to local laptops without CEO + Security Lead approval and encryption
• Email subject lines must not contain Restricted content or full document titles with PII

8. Roles

Role	Responsibility
All staff	Classify data they create or handle; follow handling table
Engineering	Implement technical controls per classification
Support	Minimum necessary access; Confidential handling in tickets
DPO	Advise on personal data and special category data
Security Lead	Policy enforcement; exceptions

9. Exceptions

Exceptions to handling requirements require documented risk acceptance approved by Security Lead (Restricted: also CEO). Maximum exception period 90 days.

10. Related documents

• Information Security Policy
• Data Retention & Disposal Policy
• Acceptable Use Policy
• Cryptography & Key Management Policy

11. Review

Reviewed annually and when new data types or processing activities are introduced.

---

Approval

Name	Role	Signature	Date
Robert	CEO / Security Lead	Electronic	11 July 2026