Data Classification Policy (A.5.12)
Document ID: data-classification-policy
Version: 1.0
Effective from: 2025-01-01
Owner: ISMS owner
Review cycle: Annual
note
This document is aligned to ISO/IEC 27001:2022 Annex A as a self-assessment. SigmaShake holds no ISO 27001 certification.
Classification levels
| Level | Description | Examples | Handling |
|---|---|---|---|
| Public | Intentionally published | Documentation, marketing, open-source rules hub | No restrictions |
| Internal | Business operations | Governance configuration, non-sensitive audit logs | Access via SSO; no external sharing without approval |
| Confidential | Sensitive business or customer data | API keys, customer governance configs, evidence blobs | Encrypted at rest and in transit; access logged |
| Restricted | Highest-sensitivity | Ed25519 private signing key, GITHUB_APP_PRIVATE_KEY, STRIPE_API_KEY | Stored outside source code (Cloudflare Secrets Store bindings, Worker secrets or the vault service); never logged; rotation target ≤ 90 days (the secrets-age and secrets-store-age collectors flag older secrets) |
Data inventory
Principal data categories and their classification:
| Data | Classification | Storage | Retention |
|---|---|---|---|
| Customer governance rule files | Confidential | D1 (Hub; the Hub has no R2 binding), with Cloudflare-managed encryption at rest | Duration of subscription |
| Compliance evidence blobs | Confidential | R2 (90-day Object Lock target, set by hand in the Cloudflare dashboard; verification is an open ISMS-owner action; the weekly r2-object-lock-verify collector checks the rules) | 90-day target; longer preserved |
| Signed manifests / audit packages | Confidential | R2 + AUDIT_PACKAGES | At least 90 days Object Lock (checked by the r2-object-lock-verify collector). No longer period is set in code. |
| SSO session tokens | Restricted | sigmashake-sso SESSIONS KV namespace (expirationTtl 8 hours) | 8 hours |
| Signing private keys | Restricted | Cloudflare Secrets Store (COMPLIANCE_SIGNING_KEY) | Current key + 1 rotation overlap |
| Incident records | Internal | D1 | Indefinite |
| Vendor DDQs | Confidential | D1 | No retention period is set in code |
Handling requirements
- Confidential and Restricted data must not appear in commit messages, log entries, or error responses returned to clients.
- Production data must not be used in test environments. Test fixtures use synthetic data only (enforced by
prod-data-masking-auditcollector). - Retention sweeper (
retention-sweepercollector, monthly) reports retention counts for the accounts, support and fleet services only. It deletes nothing. Evidence objects in R2 expire only when Object Lock retention ends.
Labelling
Data classification is enforced through system boundaries (access controls, encryption) rather than manual labelling, consistent with a cloud-native model.
Evidence
| Collector | Cadence | Control |
|---|---|---|
data-classification-audit | Weekly | A.5.12, A.5.13, A.8.11 |
prod-data-masking-audit | Weekly | A.8.11, A.8.12 |
retention-sweeper | Monthly | A.5.33, A.8.10, A.8.12 |
r2-object-lock-verify | Weekly | A.5.33, A.8.10, A.8.13 |