Confidentiality Policy

Status: Phase 30 G4.T3 deliverable — public-facing confidentiality discipline statement. Companion docs: docs/trust-center/index.md · docs/compliance/soc-2-tsc-2017-control-mapping.md (C1).

Data Classification

Claimful classifies customer data into four categories:

| Category | Examples | Protection | |---|---|---| | Public | Marketing copy, sub-processor list, status page | None required | | Internal | Aggregated platform metrics, internal runbooks | Encrypted at rest; access via SSO + MFA | | Confidential | Customer business data (merchant config, offer copy) | Encrypted at rest + in transit; RLS-isolated per tenant | | Restricted | PHI (medical evidence) + PII + payment data | Encrypted at rest + in transit; RLS-isolated per tenant; PHIGuard fail-closed pre-vendor egress (ADR 0012); restricted-evidence storage discipline (ADR 0015) |

PHI Protection

• PHIGuard fail-closed pattern per ADR 0012 — pre-vendor egress scrub + redaction.
• DICOM + FHIR redaction per Phase 29 + ADR 0059 (proposed).
• Vendor attestation freshness recheck per Phase 29 (Mistral ZRA + Anthropic ZDR + GLM self-host).
• Quarterly attestation flip-off if vendor attestation goes stale (App\Compliance\Attestation\StaleAttestationAutoDisable).

Retention + Erasure

• Data retention per merchant agreement + GDPR right-to-erasure per ADR 0029.
• Tombstone audit trail preserves audit history while satisfying erasure requests.
• Encrypted R2 originals are the authoritative source; erasure operates on cleartext mirrors first, then tombstones the encrypted original.

AI Vendor Discipline

• All AI vendors carry Zero Retention Agreements (ZRA) or Zero Data Retention (ZDR) attestations.
• Mistral ZRA + Anthropic ZDR per ADR 0011 prompt-cache strategy.
• GLM self-host per ADR 0046 (proposed) — Claimful operates the GLM instance; no third-party retention.

Source ADRs

ADR 0012 (PHIGuard fail-closed) · ADR 0015 (PII / medical encryption) · ADR 0020 (Sentry PII / PHI scrubbing) · ADR 0029 (GDPR right-to-erasure) · ADR 0059 proposed (PHIGuard DICOM + FHIR redaction).