Data Classification Framework

📄 Policy Doc Updated: Nov 12, 2025 Version: 2.4.1

This document outlines CloudNexus's data classification methodology, enforcement mechanisms, and customer responsibilities. Proper classification ensures appropriate security controls, storage optimization, and regulatory compliance across all infrastructure tiers.

Overview

Data classification is the process of categorizing information based on sensitivity, business value, and regulatory requirements. CloudNexus implements a four-tier classification model that aligns with industry standards (NIST SP 800-60, ISO 27001) while providing flexible automation for cloud-native workloads.

ℹ️ Key Principle

All data ingested into CloudNexus infrastructure must be explicitly or implicitly classified. Unlabeled assets default to Internal tier and are subject to automatic tagging and audit logging.

Classification Tiers

CloudNexus defines four distinct classification levels. Each tier dictates encryption standards, access controls, retention policies, and monitoring intensity.

Tier	Label	Description	Encryption	Access Control
Tier 1	Public	Information intended for public consumption. No confidentiality requirements.	In-Transit (TLS 1.3)	Open / CDN-Cached
Tier 2	Internal	Operational data, internal tools, non-sensitive logs. Disclosure could cause minor disruption.	In-Transit + At-Rest (AES-256)	RBAC / Authenticated
Tier 3	Confidential	PII, financial records, customer datasets, proprietary code. Breach causes significant harm.	AES-256-GCM + KMS Rotation	Strict RBAC + MFA + Audit
Tier 4	Restricted	PHI, regulated financial data, encryption keys, executive records. Subject to strict compliance.	Customer-Managed Keys (BYOK) + HSM	Zero-Trust + JIT Access + Immutable Audit

Infrastructure Enforcement

Classification isn't just policy—it's enforced at the infrastructure level through automated tagging, IAM boundaries, and storage routing.

1. Automated Tagging & Scanning

CloudNexus deploys continuous data discovery agents that scan object storage, databases, and VM disk images. Pattern matching (regex, DLP libraries) auto-applies classification labels when confidence exceeds 92%.

                    # Example: Auto-tagging response payload
{"resource_id": "vol-8f4a2c1d",
 "detected_tier": "CONFIDENTIAL",
 "confidence": 0.96,
 "policy_applied": ["encrypt-aes256", "restrict-rbac", "audit-enable"]}
                

2. Storage Routing & Lifecycle

Tier 3 & 4 data is automatically routed to isolated storage clusters with network segmentation. Lifecycle policies enforce retention windows and secure deletion (crypto-shredding) upon expiration.

3. Access Boundaries

IAM policies are dynamically generated based on classification labels. Attempting to copy Tier 4 data to a Tier 1 bucket triggers an immediate block and SOC alert.

Customer Responsibilities

While CloudNexus provides automated classification tools, customers remain responsible for:

Defining business context for custom data types
Reviewing and validating auto-tagged assets quarterly
Configuring fine-grained IAM policies for sensitive workloads
Ensuring encryption key rotation schedules meet compliance requirements
Maintaining data minimization principles in application architecture

⚠️ Shared Responsibility Model

CloudNexus secures the infrastructure and enforces baseline classification controls. Customers are responsible for accurate data categorization, application-level security, and regulatory alignment.

Compliance Mapping

Our classification framework directly supports major regulatory frameworks:

GDPR: Tiers 3 & 4 enforce pseudonymization, retention limits, and breach notification workflows.
HIPAA: Restricted tier implements ePHI safeguards, audit trails, and key escrow procedures.
SOC 2 Type II: Automated classification controls satisfy CC6.1 (Logical Access) and CC7.2 (System Operations).
ISO 27001: Aligns with A.8.2 (Information Classification) and A.9.1 (Access Control).

API Reference

Manage classification tags programmatically via our REST API or SDKs:

                    # Apply classification label to a storage bucket
PUT /api/v2/storage/buckets/{bucket_id}/classification
{
  "tier": "CONFIDENTIAL",
  "auto_rotate_keys": true,
  "retention_days": 365
}
                

Full API documentation and SDK examples are available in the Developer Portal.

Frequently Asked Questions

Can I override automated classification?

Yes. Manual overrides are supported but require administrator privileges and trigger a compliance audit log entry. Overrides must be justified in the metadata field.

How often is data rescanned?

Continuous scanning occurs in near-real-time for object storage. Block storage and database exports are scanned during backup windows or on explicit API request.

Does classification affect performance?

Minimal. Metadata tagging adds <1ms latency. Encryption operations are hardware-accelerated via AES-NI and QAT chips across all CloudNexus regions.