4. Data Classification Framework
Establishes standardized procedures for classifying, handling, storing, and transmitting data across all Aevum Zenth divisions. Ensures regulatory compliance and risk mitigation.
Framework Overview
All data generated, processed, or stored by Aevum Zenth must be classified into one of four tiers based on sensitivity, regulatory requirements, and potential business impact. Classification determines encryption standards, access controls, retention periods, and transmission protocols.
Classification Tiers
Public
Information approved for external distribution. Includes marketing materials, press releases, public financials, and open-source code.
Internal
Operational data for employee use. Internal memos, process documentation, non-sensitive project plans, and internal tooling configs.
Confidential
Restricted to authorized personnel. Customer PII, employee records, financial forecasts, patents, and proprietary algorithms.
Restricted
Critical/crown-jewel data. Executive compensation, merger/acquisition plans, cryptographic keys, government contracts, and unredacted health records.
Handling & Storage Matrix
| Data Class | Encryption at Rest | Encryption in Transit | Access Control | Retention | External Sharing |
|---|---|---|---|---|---|
| PUBLIC | None required | TLS 1.2+ | Open / Authenticated | Indefinite (if archival value) | Approved channels only |
| INTERNAL | AES-256 | TLS 1.3 | SSO + RBAC (Dept.) | 3-7 years (per jurisdiction) | Requires Data Owner approval |
| CONFIDENTIAL | AES-256 + HSM wrapping | mTLS + End-to-End | ABAC + MFA + JIT access | 7-15 years (audit trail) | NDA-bound, redacted only |
| RESTRICTED | Quantum-Resistant Lattice | Dedicated Secure Tunnel | PAM + Biometric + 4-Eyes | 20+ years / Permanent | Strictly prohibited unless legal mandate |
Automated Classification & Enforcement
Aevum Zenth utilizes ML-driven DLP (Data Loss Prevention) and metadata tagging across all cloud and on-prem infrastructure to auto-classify and enforce handling policies.
Zenth SenseAI Scanner
Continuously scans S3, Azure Blob, and on-prem NAS for unclassified files. Auto-applies tags and triggers remediation workflows.
Policy Enforcement Engine
Blocks unauthorized exports, enforces watermarking on Confidential/Restricted docs, and auto-encrypts endpoints via Zero Trust Network Access (ZTNA).
Compliance Dashboard
Real-time visibility into classification distribution, exception requests, and audit logs. Accessible via /governance/dashboard.
Exception & Escalation Process
Business units requiring temporary policy relaxation must submit a formal exception request. All exceptions are time-bound, audited, and require CISO or Division Head approval.
- Submit via Exception Portal with business justification and risk assessment.
- Automated routing to Data Owner → Legal → CISO Office.
- Approval grants temporary override (max 90 days, renewable).
- Post-exception audit required before data returns to baseline classification.