# Data Classification

Four tiers; every field in `prisma/schema.prisma` maps to exactly one. Storage, logging, and export rules differ per tier.

| Tier             | Examples                                                     | At rest                            | In logs                  | In analytics    |
| ---------------- | ------------------------------------------------------------ | ---------------------------------- | ------------------------ | --------------- |
| **Public**       | Tenant name, public announcements                            | No special handling                | OK                       | OK              |
| **Internal**     | User display name, roles, document titles                    | Encrypted disk                     | OK (no PII identifiers)  | Aggregated only |
| **Confidential** | Email, IP address, audit metadata, document blobs            | Encrypted disk + signed URLs       | NEVER raw — hash or omit | Aggregated only |
| **Restricted**   | Password hashes, refresh-token hashes, JWT secrets, FCM keys | Encrypted disk + KMS; never logged | NEVER                    | NEVER           |

## Tier per Prisma model

| Model                             | Tier                                                       | Notes                                        |
| --------------------------------- | ---------------------------------------------------------- | -------------------------------------------- |
| `Tenant`                          | Internal                                                   | Slug + name                                  |
| `User`                            | Confidential (email, avatarUrl); Restricted (passwordHash) | Display name is Internal                     |
| `Role`, `Permission`              | Internal                                                   |                                              |
| `UserRole`, `RolePermission`      | Internal                                                   |                                              |
| `RefreshToken`                    | Restricted                                                 | Hashed only                                  |
| `Department`, `OrgUnit`           | Internal                                                   |                                              |
| `Announcement`                    | Public OR Internal (depends on `visibility`)               |                                              |
| `Document`                        | Confidential (title + metadata); the blob is Confidential  |                                              |
| `ApprovalRequest`, `ApprovalStep` | Confidential                                               | `payload` may contain PII                    |
| `AuditLog`                        | Confidential                                               | `metadata` JSON — never put secrets/PII here |

## Logging rules per tier

| Tier         | Allowed in log lines?                                              |
| ------------ | ------------------------------------------------------------------ |
| Public       | ✓                                                                  |
| Internal     | ✓ (don't include identifiers like email when the userId is enough) |
| Confidential | ✗ — log the userId, not the email                                  |
| Restricted   | ✗ — never                                                          |

## In transit

TLS 1.2+ everywhere external. Internal cluster traffic on a private network.

## How to use this

When adding a field:

1. Pick its tier (default to one tier stricter than you think).
2. Confirm the logger redacts it if Confidential/Restricted.
3. Confirm the DSAR export includes/excludes per Confidential/Restricted policy.
4. Document the choice in the PR.
