Information handling policy

How we use, classify, share, keep and delete information, including personal data, and how we protect it with cryptography. It applies to every employee and to all company and customer information, in any form.

Annex A controls: 5.10, 5.12, 5.13, 5.14, 5.33, 5.34, 8.10, 8.11, 8.12, 8.24.

Acceptable use (5.10)

• Company and customer information is used for company work only.
• Information lives in company services: code in GitLab, documents in GitLab or Nextcloud, secrets in Vaultwarden. As little as possible is kept only on a laptop, see backups.
• Devices that hold company information follow the security rules: screen lock, firewall, automatic updates and full-disk encryption.
• Company information is not put on USB flash drives or other removable media.
• Confidential information goes only into the AI tools that AI tools allows for it.
• Unexpected requests by email are checked through another channel before acting on them, see phishing.

Classification and labelling (5.12, 5.13)

Information has one of three levels. Internal is the default, so most information needs no label.

Level	Meaning	Examples	Handling
Public	Approved for publication	This handbook, open-source code, websites, product documentation	No restrictions
Internal (default)	Everything that is neither public nor confidential	Issues, private source code, internal documents, chat	Employees and the collaborators of the project, in company services only
Confidential	Disclosure harms our customers, their users, people or us	Personal data, customer data, production data, credentials and keys, contracts, HR records	Only the people who need it, in restricted locations, encrypted in transit, not in cloud AI tools

• Whoever creates or receives information classifies it. When in doubt, choose the higher level or ask the Information Security Officer.
• The location labels most information. Public sites and public repositories hold public information. Production systems, and Vaultwarden collections, GitLab projects and Nextcloud folders limited to the people who need them, hold confidential information.
• A confidential document that is shared outside such a restricted location carries “Confidential” in its title.

Information transfer (5.14)

• Inside the company, information is shared through GitLab, Mattermost, Nextcloud and company email.
• Email travels encrypted: mail apps connect over TLS, and our mail server publishes DANE records so other mail servers deliver to it over verified TLS.
• Files for people outside the company go through temporary file transfer links that expire, or through a Nextcloud share link with a note on who it is for and why, see sharing outside the organization. Third-party transfer services are not used for company work.
• Credentials are never sent in plain email or chat. They are shared through Vaultwarden, or through an expiring Bitwarden Send for someone outside the company.
• Confidential information goes to an external party only under an agreement that covers it: a customer contract with a data processing agreement, a supplier contract, or a non-disclosure agreement.
• External guests in Mattermost are invited to private channels only.

Protection of records (5.33)

• Records are contracts, customer agreements, the financial and payroll administration, time registration, ID copies and the records of the ISMS.
• Signed contracts and other documents to archive go to Office & HR. ISMS records are GitLab issues and merge requests.
• Records are kept in company systems and in the accounting system, with access control and backups, so they are protected against loss, change and unauthorized access. GitLab keeps the full history of every change.
• Records are kept for their statutory period: seven years for the financial and payroll administration, and for ID copies five years after the year in which the employment ends.

Privacy and protection of personal data (5.34)

• The GDPR applies to all personal data we process: of employees, of our customers, and of our customers’ users in our SaaS products, where we act as processor.
• Each SaaS product publishes a privacy statement on its website.
• Where we process personal data on a customer’s behalf, a data processing agreement covers it.
• A product collects only the personal data it needs and uses it only for that purpose. Personal data is confidential information.
• Requests from people about their personal data, such as access or deletion, are answered within one month.
• Personal data breaches are handled through incident management and are reported to the Autoriteit Persoonsgegevens within 72 hours when the GDPR requires it.

Information deletion (8.10)

• Information is deleted when it is no longer needed and no retention period applies.
• Customer data is deleted at the end of the contract or on request, as the contract, the data processing agreement and the privacy statement state.
• Accounts of people who leave are disabled during offboarding. Their mailboxes are deleted once they have been disabled and unused for a year.
• Temporary file transfers expire and deleted password manager items are purged automatically.
• Backups age out according to the business continuity policy.
• Devices and storage media are wiped or destroyed before disposal, as the asset management policy describes.

Data masking (8.11)

• Development, test, review and staging environments use synthetic or anonymized data, not copies of production personal data.
• Production data is used in production only, by the people with production access, for support and debugging.
• Personal data is removed from screenshots, recordings and documents before they are shared, see redacting.

Data leakage prevention (8.12)

• Secrets are never committed to repositories or posted in issues or chat. They live in Vaultwarden, OpenBao or protected CI/CD variables.
• Confidential information leaves the company only through the transfer rules above.
• Laptops use full-disk encryption, and company information stays off removable media.
• Production secrets and internal services are restricted, as the access control policy describes.
• A suspected leak is reported as an incident.

Use of cryptography (8.24)

• Every service is served over HTTPS only: HTTP redirects to HTTPS, and certificates come from Let’s Encrypt and renew automatically.
• Laptops use full-disk encryption.
• Backups are encrypted before they leave the server.
• The password manager encrypts each vault with the user’s master password.
• Remote access uses the WireGuard company VPN and SSH keys.
• Software uses standard, maintained protocols and libraries for cryptography, never homemade algorithms.
• Keys and secrets are kept in Vaultwarden or OpenBao with access per collection or policy. Tokens are rotated as described in token rotation, and offboarding removes the keys of people who leave.

Responsibilities

• The Information Security Officer owns this policy.
• Each Project lead owns the privacy statement, the data processing agreements, the data subject requests, the deletion of customer data and the test data of their product.
• Infrastructure owns encryption in transit and of backups, key management, and the retention of data in company services.
• Office & HR owns the contracts and the HR and payroll records.
• Employees classify the information they create and handle it according to its level.

Review: yearly by the Information Security Officer.