SOC 2/Policies14

Asset and data management policy

Version0.1 draft

OwnerInfrastructure Owner (assets), Security Owner (data)

ReviewYearly

Applies toHardware, cloud resources, domains, repositories, SaaS accounts and data inside the SOC 2 scope, and devices used to reach them

Markdown

Asset inventory#

The inventory lists every in-scope host, database, storage bucket, domain and hostname, repository, SaaS account, and endpoint device, with an owner, environment (production, staging, development), and data classification ACC-01.
It is generated from the systems where possible (cloud API, GitHub API, Cloudflare API) and reviewed quarterly. An asset found that is not in the inventory is either added with an owner or removed.
Every hostname that serves production is in the inventory. A hostname nobody owns is removed from DNS and the tunnel.

Data classification#

Classes are the ones in the universal baseline:

P0 restricted: health, children's data, immigration status, financial accounts, precise location, government identifiers, credentials and secrets, message and email content, recordings, and the other P0 categories listed there.
P1 personal: names, emails, phone numbers, IPs, account activity, authored content.
P2 business: company data with no natural person, aggregated metrics.

For SOC 2 Confidentiality, all customer content and every P0 and P1 field is confidential information CNF-01.

Handling#

Class	Storage	Sharing	Logs and analytics	AI providers
P0	Encrypted at rest; access logged	Only to processors in the vendor register approved for P0	Never	Only where the app register approves the specific provider for that data
P1	Encrypted at rest	Only to processors in the vendor register	Identifiers only where needed; no content	Only approved providers
P2	Normal	Allowed	Allowed	Allowed

Every in-scope product keeps a data map (docs/DATA_MAP.md) listing each field, class, purpose, retention, location and processor CNF-01. A new flow of confidential data to a new system or vendor passes the SOC 2 gate and updates the vendor register first CNF-02.

Disposal of media#

Disks, laptops, phones and removable media that held customer data are wiped with a verified method (cryptographic erase of an encrypted disk, or a NIST 800-88 purge) or physically destroyed before disposal, sale or return. A record names the asset, the method, the date and the person ACC-16. For cloud storage, disposal is the provider's control and is covered by their report.