Data Classification Policy

1. Purpose

This policy defines how Subcontext classifies data and the controls applied at each classification level. Classifying data consistently means everyone handling it knows how sensitive it is, who may see it, how it must be protected and how long it may be kept. It underpins the Information Security Policy, the Access Control Policy, the Encryption & Key Management Policy and the Data Retention & Deletion Policy, which each rely on the levels set out here.

2. Scope

This policy applies to:

• All data Subcontext creates, collects, receives or stores, in any form, including data in the platform's database, file storage, cache, logs, backups, exports, source code, email and documents
• Data Subcontext processes on behalf of customers (as a processor) and data it holds for its own purposes (as a controller), such as platform user accounts, billing records, and sales and marketing contacts
• Everyone who handles Subcontext data: directors, employees, contractors and anyone else given access, referred to in this policy as "staff"
• Systems operated by Subcontext and, through contract, the sub-processors on the published Sub-Processor List

3. Definitions

4. Classification Levels

4.1 Impact if disclosed

The level reflects the harm that unauthorised disclosure, alteration or loss could cause:

5. Handling Requirements

5.1 How the platform meets these requirements

5.2 Rules for staff

• Public: may be published or shared freely once approved for publication
• Internal: kept within Subcontext's own systems and accounts; not posted publicly
• Confidential: accessed only through the platform or approved systems, only when needed for a task; never copied to personal devices, personal accounts or unapproved tools; never pasted into AI tools or services that are not approved sub-processors; exports are deleted once their purpose is served
• Restricted: never stored in source code, tickets, chat messages, email or documents; held only in AWS Secrets Manager or the application's encrypted credentials; shared only with the named individuals who need it; rotated immediately on any suspected exposure, in line with the Encryption & Key Management Policy

6. Customer Data

All customer data processed through the platform is classified as Confidential or higher. This includes:

• Contact personal data (names, emails, phone numbers)
• Conversation content
• Agent configurations and knowledge bases
• Integration credentials (classified as Restricted)
• Payment transaction data

Customer data also includes, and is treated as Confidential or higher:

• Call audio and voice recordings
• Insurance applications, quotes, policies and claims
• Health information collected for an insurance application, which is special category data under the UK GDPR and is collected only after explicit consent is recorded
• Direct Debit bank details, which are additionally encrypted in the application

Card details are never stored by Subcontext: they are handled by Stripe.

Customers decide what personal data they put into the platform and remain controllers of it. Subcontext applies this policy to all of it regardless of how the customer itself classifies it.

7. Classifying Data

7.1 When classification happens

• Data classification is determined at the point of creation or collection
• Each new feature, data store, integration or export is classified as part of its design, and the classification informs which controls are built in
• Classification is reviewed when data is combined, aggregated or moved to a new purpose, since combined data can be more sensitive than its parts

7.2 Worked examples

8. Roles and Responsibilities

• All employees are responsible for handling data in accordance with its classification
• Directors: approve this policy and any exception to it, and give the executive approval required before Restricted data is shared externally
• Security Officer: a member of the founding team who owns the security programme, maintains this policy, advises on classification questions and checks compliance
• Data owners: decide the classification of the data they are responsible for and make sure the right controls are applied
• Staff: handle data according to its classification, and report any mishandling or suspected exposure straight away under the Incident Response Plan
• Customers: as controllers, decide what data they place on the platform and who in their organisation can access it

When in doubt, apply the higher classification level.

9. Exceptions

Any exception to this policy, for example sharing Confidential data with a party not covered by an agreement, must be requested in writing to the Security Officer, setting out the data, the reason, the period and any compensating controls. Exceptions are approved by a director, recorded, time-limited and reviewed before they expire. Sharing Restricted data externally always requires executive approval.

10. Compliance

• The Security Officer checks compliance with this policy at least annually, including a review of where Confidential and Restricted data is stored and who can access it
• New features are checked against the handling requirements before release, as part of the Secure Development Policy
• Mishandling of data is treated as a security incident under the Incident Response Plan, and may lead to disciplinary action under the Staff Security Policy

11. Related Documents

• Information Security Policy
• Access Control Policy
• Encryption & Key Management Policy
• Data Retention & Deletion Policy
• Logging & Monitoring Policy
• Secure Development Policy
• Staff Security Policy
• Incident Response Plan
• Sub-Processor List

12. Document Control