Data Classification and Encryption Policy

Summary. We classify all information into four levels and apply handling rules to each. Sensitive data is encrypted in transit and at rest.

Classification levels

Level	Examples	Handling
Public	Website content, published policies	No restrictions.
Internal	Internal procedures, non-sensitive project notes	Personnel only. Not shared externally without approval.
Confidential	Client business data, source code, contracts, financial records	Need-to-know access, encrypted in transit and at rest, shared only under confidentiality terms.
Restricted	Personal data (including buyer names, addresses and order details from marketplaces), passwords, API keys, access and refresh tokens	Strictest access controls, encrypted in transit and at rest, never stored on removable media or in email, and deleted when no longer needed.

If the classification of information is unclear, it is treated as Restricted until the Director decides otherwise.

All websites, APIs and applications are served only over HTTPS using TLS 1.2 or higher, with HSTS enabled.
Calls to third-party and marketplace APIs are made only over TLS.
Administrative access to servers uses SSH. Unencrypted protocols (for example plain FTP) are not used to transfer Confidential or Restricted data.

All laptops and workstations use full-disk encryption (FileVault or BitLocker).
Restricted secrets, such as marketplace access and refresh tokens and API credentials, are held only in databases that listen on private interfaces and are not reachable from the internet. They are never stored in source code, email, chat tools or on removable media.
User passwords are never stored. Only strong one-way hashes (bcrypt or Argon2) are kept.
Backups containing Confidential or Restricted data are stored in access-restricted locations available only to the Director.
Production data is hosted in an access-controlled data centre operated by our hosting provider in Germany.

Any application that connects to a marketplace or sales-channel API (for example TikTok Shop) must meet the following before it processes live data:

Access and refresh tokens, API secrets and other Restricted credentials are encrypted at the application level (AES-256) before being written to the database, with encryption keys held separately in environment configuration.
Personal data received from the platform is stored only in the production environment, which runs on a server with a default-deny firewall and a database that is not reachable from the internet.
Only the API scopes needed for the authorised service are requested, and data is used only for that service.
Tokens and personal data are deleted when the seller revokes authorisation or the service ends, as set out in the Data Protection Policy.
The application passes a security review against this policy set, including a dependency vulnerability audit, before go-live.

Restricted data is not copied to personal devices, personal cloud storage, email or chat tools.
Test and development environments use synthetic or anonymised data wherever possible.
Printed Confidential or Restricted information is kept to a minimum, stored securely and shredded after use.

Data is kept only as long as needed for its purpose or required by law. Retention periods are set in the Data Protection Policy.
When data is deleted it is removed from live systems. It then expires from backups within the backup retention period.
Devices and storage media are securely wiped before reuse or disposal.

Document	Data Classification and Encryption Policy
Organisation	SKYLARK SPHERE LTD (company no. 17031142)
Version	1.0, approved by the Director on 22 September 2026
Review	At least annually, and after any significant incident or change. Next review: September 2027.