# Data classification (/docs/maintain/security/data-classification)

- **Status:** Binding (ADR-0005, approved 2026-11-01)
- **Last updated:** 2026-10-31
- **Related ADRs:** ADR-0005

> Snapshot of the system as it stands today. Edit in place; never record what changed.

Every piece of content, every stored field and every piece of data that leaves the system has
one level. When a level is unclear, **ask** — never assign one by assumption
([ADR-0004](../adr/ADR-0004-ask-never-guess.mdx)).

## Levels [#levels]

| Level | Meaning | Examples | Handling |
|---|---|---|---|
| **Public** | Safe for anyone, anywhere | Documentation of public packages and public projects; the Algolia app ID and search-only key | May go on every published surface |
| **Internal** | Not secret, not meant for readers | Build configuration, unfixed security findings | Stays in the repository or with the owner; never in `content/` |
| **Confidential** | Belongs to a private project | Its documentation, architecture, internal APIs, roadmap, hostnames | Never on a public surface; served only as its ADR decides, to the readers it names |
| **Restricted** | Disclosure enables abuse or harms someone else | Secrets and API keys, client names and client data, personal data | Never in content, examples, screenshots, logs or the search index; secrets only in environment files and secret stores |

## Classified so far [#classified-so-far]

| Data | Level | Why |
|---|---|---|
| `content/<slug>/` (package and project pages; today only this site's own, `content/docs/`) | Public | Published on every surface today |
| `content/docs/maintain/` (this site's decisions, design and security documents) | Public | Published by the owner's decision (ADR-0002); holds variable names, never values |
| `NEXT_PUBLIC_ALGOLIA_APP_ID`, `NEXT_PUBLIC_ALGOLIA_SEARCH_KEY` | Public | Shipped to every browser by design |
| `ALGOLIA_WRITE_KEY` | Restricted | Write access to the live search index |
| GitHub usernames of deciders and approvers in ADRs | Public | Already public on GitHub; written only with the owner's yes for anyone but `puncoz`, who approves for the owner (ADR-0020, ADR-0039). A person's other personal data stays Restricted |

## Rules that follow [#rules-that-follow]

- **A page's level is decided before it is written.** If a project's visibility is not
  recorded, ask.
- **Published surfaces carry Public content only**, until an ADR defines how Confidential
  content is served.
- **Third-party crossings** (`content/docs/maintain/dfd/`) state the level of everything sent.
- **Examples use invented values**, so they stay Public whatever they document.

## Open [#open]

For the owner to decide with the private-documentation ADR:

- Where Confidential content lives: a separate repository, a separate deployment, or this site
  behind authentication.
- Whether a private project's *existence* (its name in a list) is Public or Confidential.