Data Classification Policy

1. Purpose

This policy defines a single classification scheme for the information Lever AI handles, so that everyone working for or on behalf of the company knows how sensitive a piece of information is and how it must be stored, transmitted, shared, and disposed of. The Data Protection and Privacy Policy contains a summary classification table; this policy is the authoritative definition of the company's classification scheme and carries the handling requirements, and where the two differ on the classification of any information or on its handling, this policy prevails. It is informed by ISO/IEC 27001:2022 Annex A and supports the company's obligations as a processor of customer data.

2. Scope

This policy applies to all Lever AI personnel and to any contractor or third party acting on the company's behalf. It covers all information the company creates, receives, processes, stores, or transmits, in any form and in any location — the production cloud environment, source-control and collaboration systems, work devices, and information handled on behalf of customers.

3. Policy

3.1 Classification scheme

All information is classified into one of four classes:

• Public — information approved for release outside the company, whose disclosure causes no harm. Examples: website content and published marketing material.
• Internal — routine business information whose disclosure would cause limited harm. Examples: internal documentation, engineering notes and plans, and operational records that identify no customer.
• Confidential — information whose disclosure would cause significant harm to the company or a business partner. Examples: contracts and commercial terms, security documentation and questionnaire responses, risk, audit, and incident records, and Lever AI source code (which contains no customer data).
• Restricted — the most sensitive class, whose disclosure would cause serious harm to a customer, to the individuals whose data a customer has entrusted to us, or to the company. Examples: all customer data — uploaded requirement documents, tenant configuration data read or written on the customer's instruction, administrator chat and agent session transcripts, and customer-attributable operational telemetry — and all credentials and secrets, including service credentials, API tokens, and cryptographic keys.

3.2 Default classifications

Customer data is Restricted by default, in every form it takes. Credentials and secrets are always Restricted and are never reclassified downward. Information that has not been explicitly classified is treated as Internal at a minimum; where there is doubt between two classes, the higher class applies until the Security Owner decides. Where a customer designates handling requirements for its own data that are stricter than this policy, the customer's designation applies to that data.

3.3 Handling requirements

The following matrix states the minimum handling required for each class. Encryption standards referenced here are defined in the Cryptography and Encryption Policy; access rules are defined in the Access Control Policy; device and media rules are defined in the Physical Security Policy.

3.4 Labelling and identification

Classification operates primarily at the level of systems and data categories rather than per-file labels: the production data stores hold Restricted data and are handled accordingly; source-control repositories hold Confidential material; and the categories in section 3.1 tell personnel the class of what they are handling without a label. Documents created for sharing outside the company are marked with their classification where it is Confidential or above, and the company's policy documents carry the marking “Confidential · Internal”.

3.5 Reclassification and aggregation

The Security Owner may reclassify information as its sensitivity changes. Any downgrade of classification, and any release of previously non-public information as Public, requires the Founder's approval. Aggregation can raise sensitivity: a collection of Internal records that together reveal Confidential or customer-identifying information is handled at the higher class.

4. Responsibilities

The Security Owner maintains the classification scheme, decides classification where there is doubt, and approves handling arrangements for new systems and data categories. The Founder approves public release and any downgrade of classification. Every member of staff is responsible for handling information according to its class and for raising anything that appears to be held or shared below its proper class. Detailed assignments are set out in the Security Roles and Responsibilities document.

5. Exceptions

Any exception to this policy must be requested in writing, assessed for risk, limited in time, recorded, and approved by the Founder. Exceptions are reviewed at each policy review, and no exception may permit customer data or credentials to be handled below the Restricted requirements without the affected customer's agreement.

6. Review

This policy is reviewed at least annually and whenever there is a significant change to the business, the data the company handles, or the systems that hold it. The document owner maintains its version history.