Skip to content

Information Classification Procedure

Purpose. How Soon classifies information and what each level means in practice. The Asset Management Policy states that information is classified; this procedure is the part people actually use — which level applies, and what you may and may not do with information at that level. Serves ISO/IEC 27001 A.5.12 (classification) and A.5.13 (labelling), and SOC 2 CC6.1.

1. Scope

All information Soon creates, receives or processes, in any form: platform data, documents, code, tickets, messages, logs and backups. Applies to everyone in §3 of the Access Control Policy — founders, contractors and any external party granted access.

2. The four levels

The scale is Public · Internal · Confidential · Restricted. The owner of the information assigns the level, guided by the harm that disclosure, loss or unauthorised change would cause — to customers first, then to Soon.

Level What it is Examples
Public Already published, or intended for publication. No harm from disclosure. Marketing site, published policies, the Trust Centre, public API documentation, job adverts
Internal Everyday working information. Disclosure would be unwelcome but not damaging. ISMS documents, meeting minutes, internal plans, most Linear tickets, non-sensitive team discussion
Confidential Business-sensitive. Disclosure would cause commercial, legal or reputational harm. Contracts and DPAs, pricing negotiations, financials, security findings and pentest reports, architecture detail, source code, incident records
Restricted The highest level. Disclosure would harm customers or their people, or breach GDPR. Customer workforce personal data (names, schedules, worked hours, leave and absence records), credentials, API keys and tokens, production database contents and backups

When in doubt, classify up. Two rules of thumb: anything containing another person's personal data is at least Restricted; anything that would embarrass a customer if it appeared in public is at least Confidential.

Aggregation raises the level: individually harmless records can become Restricted in bulk. A single anonymised shift pattern is Internal; an export of a customer's entire roster is Restricted.

3. Handling rules

Public Internal Confidential Restricted
Where it may live Anywhere Soon's approved tools Soon's approved tools, access limited to those who need it Production systems and the approved store only — never on a laptop, never in chat, never in a personal account
Who may see it Anyone Everyone at Soon Named individuals or a defined role Least privilege, individually granted, MFA required, reviewed quarterly
Sharing outside Soon Freely Case by case Confidentiality agreement in place first Only under a contract that permits it (customer DPA or sub-processor agreement) — never ad hoc
AI tools Fine Approved tools on a company account Approved tools on a company account, terms must exclude training on our data Never — see Acceptable Use §2.6
In transit — TLS TLS TLS 1.2+, and never over a channel not on the approved list
At rest — — Encrypted Encrypted (AES-256, KMS)
Copies and exports — Fine Minimise; delete when done Do not export. Work in the platform. Any unavoidable export is deleted immediately after use
Disposal — Normal deletion Normal deletion Per the Records Retention Policy; customer data deleted 90 days after contract end

The strictest classification present governs the whole item: a document containing one Restricted paragraph is Restricted.

4. Labelling (A.5.13)

Labelling is only useful where it is automatic, so Soon labels where the tool supports it rather than requiring manual marking everywhere:

  • ISMS documents carry a classification: field in their front matter. This is checked by tools/isms.py check and is the primary labelling mechanism.
  • The Information Asset Inventory records a classification per asset.
  • Repositories are private by default; the few public ones are Public by definition.
  • Documents in Google Drive holding Confidential or Restricted information are kept in a restricted-access folder rather than individually marked — access control is the stronger signal.
  • Ad-hoc material (a message, an export) is not labelled. The handling rules in §3 apply on the basis of content, not a label; this is why §2's rules of thumb matter more than any marking scheme.

5. Reclassification

Information can change level. Security findings are Confidential while open and may become Public once remediated and published; a draft policy is Internal and becomes Public on publication. The owner reclassifies, and where the level drops, checks that the earlier handling did not leave copies somewhere the new level would not permit.

6. Roles and responsibilities

Role Responsibility
Information owner (the person or role accountable for the asset) Assigns and reviews the classification
Information Security Manager (Olaf Jacobson) Maintains this procedure; resolves disagreements about level
Everyone Applies the handling rules in §3; asks the ISM if the level is unclear rather than guessing downwards

Change log

Version Date Author Comments
0.1 2026-09-08 ISMS First version. Created because the classification scheme was in use across the ISMS and named in the Statement of Applicability against A.5.12, but the procedure defining what each level means in practice did not exist — so nothing said what may be done with information at a given level. Handling rules drawn from the Acceptable Use, Access Control, Cryptographic and Records Retention policies, which already implied them separately.