# 14 Asset and data management policy

| | |
| --- | --- |
| Version | 0.1 draft |
| Owner | Infrastructure Owner (assets), Security Owner (data) |
| Review | Yearly |
| Applies to | Hardware, cloud resources, domains, repositories, SaaS accounts and data inside the SOC 2 scope, and devices used to reach them |

## Asset inventory

1. The inventory lists every in-scope host, database, storage bucket, domain and hostname, repository, SaaS account, and endpoint device, with an owner, environment (production, staging, development), and data classification (ACC-01).
2. It is generated from the systems where possible (cloud API, GitHub API, Cloudflare API) and reviewed quarterly. An asset found that is not in the inventory is either added with an owner or removed.
3. Every hostname that serves production is in the inventory. A hostname nobody owns is removed from DNS and the tunnel.

## Data classification

Classes are the ones in the [universal baseline](/playbook/02-universal-baseline#data-inventory-and-classification):

- **P0 restricted**: health, children's data, immigration status, financial accounts, precise location, government identifiers, credentials and secrets, message and email content, recordings, and the other P0 categories listed there.
- **P1 personal**: names, emails, phone numbers, IPs, account activity, authored content.
- **P2 business**: company data with no natural person, aggregated metrics.

For SOC 2 Confidentiality, all customer content and every P0 and P1 field is **confidential information** (CNF-01).

## Handling

| Class | Storage | Sharing | Logs and analytics | AI providers |
| --- | --- | --- | --- | --- |
| P0 | Encrypted at rest; access logged | Only to processors in the vendor register approved for P0 | Never | Only where the app register approves the specific provider for that data |
| P1 | Encrypted at rest | Only to processors in the vendor register | Identifiers only where needed; no content | Only approved providers |
| P2 | Normal | Allowed | Allowed | Allowed |

Every in-scope product keeps a data map (`docs/DATA_MAP.md`) listing each field, class, purpose, retention, location and processor (CNF-01). A new flow of confidential data to a new system or vendor passes the [SOC 2 gate](/soc2/05-soc2-gate) and updates the vendor register first (CNF-02).

## Disposal of media

Disks, laptops, phones and removable media that held customer data are wiped with a verified method (cryptographic erase of an encrypted disk, or a NIST 800-88 purge) or physically destroyed before disposal, sale or return. A record names the asset, the method, the date and the person (ACC-16). For cloud storage, disposal is the provider's control and is covered by their report.