Data Handling Policy¶
Classification: Internal
Document status: Effective
Version: 1.1
Owner: Management / Security Owner
Review cycle: Annual; interim revision upon material change to data categories, customer contracts, or law
Document control¶
| Role | Name |
|---|---|
| Prepared by | Management / Security Owner (Cloudnaut) |
| Reviewed by | Sandeep AC |
| Approved by | Sandeep AC |
Revision history¶
| Version | Date | Summary | Reviewed by | Approved by |
|---|---|---|---|---|
| 0.9 | 2021-03-14 | Draft for third-party review prior to first effective release. | Nidhi Jain (third party) | — |
| 1.0 | 2021-06-18 | Initial effective release. | Nidhi Jain (third party) | Sandeep AC |
| 1.0 | 2024-03-11 | Scheduled annual review; clarifications and cross-references (retained at version 1.0). | Nidhi Jain (third party) | Sandeep AC |
| 1.1 | 2026-10-15 | Added information classification levels and retention/disposal rules; linked incident response and AI policies. | Sandeep AC | Sandeep AC |
Purpose¶
This policy defines how Cloudnaut handles customer confidential, sensitive, and regulated categories of data.
Scope¶
This policy applies to personal, health, financial, educational, proprietary, confidential, and other regulated or contractually protected data encountered during customer engagements.
Policy¶
Personnel access customer regulated or confidential data only when explicitly authorized by the customer, required for the engagement, and approved through the engagement’s governance path. Access follows need-to-know and least privilege.
Personnel use customer-approved accounts, repositories, environments, and transfer mechanisms. Customer data is not copied to personal equipment, unmanaged storage, or repositories outside the engagement boundary.
Information classification¶
Cloudnaut classifies information into four levels. Customer classifications and handling rules take precedence where the customer defines them.
| Level | Description | Examples | Minimum handling |
|---|---|---|---|
| Public | Approved for public release. | Published policy site, marketing material. | No restriction on disclosure; changes approved by owner. |
| Internal | For Cloudnaut personnel and authorized parties; low impact if disclosed. | Internal procedures, non-sensitive project plans. | Company-managed systems only; share on need-to-know. |
| Confidential | Disclosure could harm Cloudnaut or a customer. | Customer source code, architecture, contracts, security evidence, personnel records. | Need-to-know access; encrypted endpoints; customer-approved or company-approved storage only; no public or personal storage. |
| Restricted | Highest sensitivity; serious harm if disclosed. | Credentials, keys, secrets; customer personal, health, or financial data; screening reports. | Explicit authorization; approved secret managers or customer systems only; never in source control, chat, email, or AI tools unless the customer has approved that specific tool and use. |
Customer information is treated as Confidential at minimum unless the customer specifies otherwise.
Retention and disposal¶
Customer information is retained only for the duration the engagement requires, then returned or deleted as the contract specifies. Copies on Cloudnaut endpoints are deleted at engagement end or on offboarding (see HR Security Policy). Company records are retained per legal and contractual requirements. The retention schedule is maintained internally by management.
Awareness¶
Personnel complete security training that covers identification of sensitive data, avoidance of unnecessary access, and escalation when work may exceed agreed data scope.
Handling rules¶
- Store and transfer data only on customer-approved systems.
- Do not commit customer data, secrets, or credentials to source control.
- Segregate customer work using organization, group, project, repository, and access boundaries as defined for each customer.
- Report suspected unauthorized access, loss, or disclosure without delay per the Incident Response and Management Policy.
- Do not enter Confidential or Restricted information into AI tools except as permitted by the AI Governance and Acceptable Use Policy.
Records¶
Typical evidence includes training records, access approvals, repository membership, customer correspondence authorizing access, and incident records where relevant.