Data classification

<h2>Classification tiers</h2> <table><thead><tr><th>Tier</th><th>Definition</th><th>Examples at HiringCoachAI</th><th>Handling</th></tr></thead><tbody><tr><td><strong>Public</strong></td><td>Intentionally disclosed; no harm from publication</td><td>Marketing site copy, blog posts, pricing page, published policies in this directory</td><td>May be hosted on CDN; no encryption required beyond TLS</td></tr><tr><td><strong>Internal</strong></td><td>Non-public but low-sensitivity business information</td><td>Internal roadmaps, commit history, non-customer telemetry, build logs</td><td>Access limited to personnel; stored in authenticated systems</td></tr><tr><td><strong>Confidential</strong></td><td>Personal data or proprietary information; breach would harm users or business</td><td>User resumes, cover letters, contacts, job applications, chat/audio transcripts, email addresses, names, phone numbers, usage analytics tied to identity</td><td>Encrypted at rest; TLS in transit; access logged; retention bounded</td></tr><tr><td><strong>Restricted</strong></td><td>Highest-sensitivity; breach is reportable or materially damaging</td><td>Authentication secrets, Firebase service-account keys, Stripe live keys, OAuth refresh tokens, encrypted LinkedIn cookies, NextAuth session tokens, backup encryption keys, payment card data (we never store: Stripe tokenizes)</td><td>Encrypted at rest with strong keys; minimum-access principle; rotation schedule; 2-person review for changes</td></tr></tbody></table> <h2>Handling matrix</h2> <table><thead><tr><th>Requirement</th><th>Public</th><th>Internal</th><th>Confidential</th><th>Restricted</th></tr></thead><tbody><tr><td>HTTPS/TLS in transit</td><td>✅</td><td>✅</td><td>✅</td><td>✅</td></tr><tr><td>At-rest encryption</td><td>✅</td><td>✅</td><td>✅</td><td>✅</td></tr><tr><td>Field-level encryption (e.g., AES-GCM on top of platform encryption)</td><td>—</td><td>—</td><td>Recommended for OAuth tokens, phone</td><td>Required</td></tr><tr><td>Access logging</td><td>—</td><td>—</td><td>✅</td><td>✅</td></tr><tr><td>Authorization</td><td>—</td><td>Employee</td><td>User-scoped or admin</td><td>Tightly-scoped role; current administrative accounts required by policy to use Google Account MFA</td></tr><tr><td>Storage duration</td><td>Indefinite</td><td>Indefinite</td><td>Bounded (see <a href="/trust/docs/data-map">data map</a>)</td><td>Minimum needed</td></tr><tr><td>May leave approved regions</td><td>✅</td><td>✅</td><td>Only via DPA-signed sub-processors</td><td>Never without approval by the Security Officer</td></tr><tr><td>Logging into Sentry/analytics</td><td>✅</td><td>✅</td><td>Redacted or hashed only</td><td>Never</td></tr></tbody></table> <h2>Labeling</h2> <p>Data is classified by <strong>where it lives</strong>, not by field-level tagging:</p> <ul><li><code>users/*</code> + subcollections → <strong>Confidential</strong></li><li><code>linkedinCookies/<em></code> (encrypted field), <code>accounts/google-drive:</em></code> (field-encrypted OAuth credentials), <code>sessions/<em></code> → <strong>Restricted</strong>. Ordinary NextAuth <code>accounts/</em></code> provider rows retain identity metadata only after the guarded OAuth credential migration.</li><li>Stripe customer/subscription IDs → Confidential (identifiers, not card data)</li><li>Firestore backups → inherit classification of source data</li><li>Environment variables containing keys/secrets → <strong>Restricted</strong></li><li>Sentry error payloads → Confidential (PII scrubbed via <code>@sentry/nextjs</code> beforeSend in production)</li><li>Audit log (<code>auditLog/*</code>) → Confidential</li></ul> <h2>Responsibilities</h2> <ul><li><strong>Engineering</strong> ensures new collections/fields are classified on introduction; the SDLC checklist requires this.</li><li><strong>Security Officer</strong> reviews classifications quarterly in the internal audit.</li><li><strong>All personnel</strong> handle data according to its tier.</li></ul> <h2>Examples of misuse</h2> <ul><li>Pasting a customer resume into a public issue tracker → violation (Confidential → Public).</li><li>Emailing a service-account JSON to a vendor → violation (Restricted).</li><li>Adding a field to the user document without classifying it → violation of SDLC.</li></ul> <h2>Related</h2> <ul><li><a href="/trust/docs/data-map">data map</a>: per-field inventory with classification</li><li><a href="/trust/docs/access-control-policy">access control policy</a>: who accesses what</li><li><a href="/trust/docs/data-retention">data retention policy</a>: retention schedule</li></ul>