Techly Data Classification Policy

Purpose

Information needs protecting in proportion to the harm its disclosure would do. This policy gives Techly Operations Pty Ltd (Techly) four levels to sort information into, and says how each is handled.

Scope

All information Techly holds or processes, in any form: in Pyron, in Techly's cloud accounts and tools, in email and chat, and on paper.

The four levels

Level	What it is	Examples
Public	Published on purpose, for anyone to read	Pyron's website, this Trust Centre, the legal pages, the security.txt file
Internal	Techly's working information, whose disclosure would do little harm	Internal documentation and runbooks, plans, meeting notes
Confidential	Disclosure would harm Techly or a customer	Pyron's source code, infrastructure configuration, the risk register and security findings, contracts and prices agreed with a customer, operational logs and metrics, error reports, staff records
Restricted	Disclosure could seriously harm a customer or the people whose information it is	Everything a customer keeps in Pyron (Customer Data), each workspace's audit trail, backups, credentials and secrets, Pyron AI's prompts and answers

Customer Data is always Restricted. That covers every record, form, file, comment, page, automation and conversation in a customer's workspace, whatever it contains, because Techly cannot know what a customer has recorded. When information could fit two levels, it takes the higher one.

Handling

Public. Published only through a change to the website made under the Techly Change Management Policy.

Internal. Kept in Techly's own systems (its GitHub organisation and Google Workspace). Shared outside Techly only when there is a reason.

Confidential. Everything Internal requires, and:

• access only for staff whose work needs it;
• shared outside Techly only under a confidentiality obligation, such as a contract;
• never committed to source code if it is a secret: secrets are held in AWS's encrypted parameter and secret stores.

Restricted. Everything Confidential requires, and:

• stored only in Pyron's production systems and with the service providers the Privacy Statement names;
• encrypted at rest and in transit;
• reached by staff only through Pyron itself, where every view and change is recorded on the workspace's audit trail, or through the production systems' own access controls;
• never copied to a laptop, an email, a chat or a ticket.

Two exceptions are allowed, each for as short a time as the work needs:

1. Diagnostics. Fixing a fault can mean reading an error report or a log that contains a fragment of Customer Data. That is done on a device that meets the Techly Acceptable Use Policy, with tools Techly approves for engineering work. Those tools may keep their own working record for a short time, and nothing is copied anywhere else.
2. Migrating a legacy workspace. Moving a customer's data from Techly's earlier platform runs in a working database on the Technical Director's computer, and that copy is deleted as soon as the migration is checked.

Customers' own classifications

A customer decides how to classify its own information. Inside Pyron, a customer controls who can see what through roles, shares and guest access. Whatever a customer's own classification, Techly handles all Customer Data as Restricted.

Who is responsible

• The Technical Director owns this policy and decides the level of anything unclear.
• Staff handle information at its level, and report anything Restricted found where it should not be, as a possible incident.

Review

The Technical Director reviews this policy every year, and when Techly starts holding a new kind of information.