Policies and compliance · NY registration 7798491

Data Classification and Encryption Policy

DNZ Consulting LLC · Effective August 27, 2026 · Next review August 27, 2027

This policy sorts information into levels. It states how to handle each level and how to encrypt it.

1. Scope and ownership

This policy applies to every system, device, and person that DNZ Consulting LLC uses to do business. DNZ Consulting LLC is a small company. The Managing Member owns this policy. The Managing Member also acts as the Security Officer and the Data Protection Officer.

The Managing Member reviews this policy one time each year. The Managing Member also reviews it after any security incident.

2. Classification levels

Level	What it covers	Handling rule
Restricted	Personal data, buyer contact data, access tokens, API keys, credentials, financial records	Encrypt at rest and in transit. Access by named person only. Never send by plain email. Never place in source code.
Confidential	Merchant business data, order data, pricing, source code, contracts	Encrypt in transit. Store in a private repository or a private bucket. Share only with a business need.
Internal	Internal notes, drafts, configuration that holds no secret	Keep inside company systems. Do not publish.
Public	Published policies, marketing pages, public documentation	No restriction.

3. Encryption in transit

Every connection uses TLS 1.2 or higher.
Every website uses HTTPS. We redirect HTTP to HTTPS.
Server administration uses SSH with a public key.
We never send Restricted data over an unencrypted channel.

4. Encryption at rest

Every laptop and desktop uses full-disk encryption. macOS uses FileVault with AES-256.
Every mobile device uses the platform hardware encryption.
Managed databases use encryption at rest through the hosting provider.
Backups are encrypted.
Secrets live in the macOS Keychain or in the platform secret store. They are never in a plain file.

5. Labelling

Store Restricted data in a location that only holds Restricted data. Name the location clearly. Do not mix levels in one folder.

6. Deleting data

Delete Restricted data when its retention period ends.
Use a cryptographic erase for a device.
Shred paper that holds Restricted data.

7. Review

The Managing Member reviews this policy one time each year.