Purpose

To ensure that information is classified, protected, retained and securely disposed of in accordance with its importance to the organization.

Scope

All Sourcegraph data, information and information systems.

Policy

Sourcegraph classifies data and information systems in accordance with legal requirements, sensitivity, and business criticality in order to ensure that information is given the appropriate level of protection. Data owners are responsible for identifying any additional requirements for specific data or exceptions to standard handling requirements.

Information systems and applications shall be classified according to the highest classification of data that they store or process.

Data Classification

To help Sourcegraph and its employees easily understand the level of security to be used for all types of information, the company has created these categories under which data can fall:

Restricted

Audience: limited number of people can access, only under break-glass scenarios.

Following items are examples of such data:

• Customer private code
• Private code on sourcegraph.com
• Individual (non-shared) account passwords

Private

Audience: limited number of people can access

Following items are examples of such data:

• Other customer non-personal data
• Production secrets