Data Privacy Standard¶
We handle our clients' data and their users' personal data. Mishandling it harms people, breaks contracts, and can break the law. This standard sets the floor for every project; a client's data protection terms and the applicable law (such as GDPR) add to it and win where they are stricter.
Classify data first¶
Every project records, in docs/ARCHITECTURE.md (Data section), which data it holds and its class:
| Class | Examples | Handling |
|---|---|---|
| Public | Marketing content, published docs | No restrictions |
| Internal | Internal configs, non-sensitive business data | Team access only |
| Confidential | Client business data, source code, contracts | Need-to-know; encrypted in transit and at rest |
| Personal / sensitive | Names, emails, phone numbers, IDs, health, financial, location, credentials | Confidential rules plus everything below |
Rules for personal data¶
- Collect the minimum. Do not store personal data you do not need for a stated purpose.
- Production data stays in production. Never copy it into development, staging, tests, fixtures, screenshots, or tickets. Use synthetic or properly masked data. Exceptions need written approval from the Tech Lead and the client.
- Never in logs, error messages, analytics events, or URLs (see the Observability Standard).
- Encrypted in transit (TLS) and at rest; access limited to the services and people that need it.
- Retention is defined. Each kind of personal data has a retention period and a deletion path,
recorded in
docs/ARCHITECTURE.md. Data past its retention is deleted, not archived "just in case". - Deletion and export requests can be met: the project knows where a person's data lives.
Third parties and AI services¶
Sending data to an external service (an API, a SaaS tool, an AI model or coding assistant) is a disclosure.
- Personal or confidential client data goes only to services the client contract allows, under a data processing agreement.
- Do not paste client code, data, or credentials into AI tools that the client has not approved, and never into tools that train on inputs.
- New third-party data flows are recorded in an ADR.
Reviews and incidents¶
- Changes that add or change processing of personal data ask for a code owner's review - CODEOWNERS routes the request (see the Code Review Standard); merging without it needs a stated reason on the PR.
- A suspected leak of personal data is treated as a security incident: report it immediately through
SECURITY.md. Legal notification deadlines can be as short as 72 hours, so do not wait to be sure.
When in doubt, leave it out
If you are not sure whether data is personal, treat it as personal.