Skip to content
aYOUne

Data Classification and Encryption Policy

Data Classification and Encryption Policy

Organisation: tolinax UG (haftungsbeschränkt), operator of the aYOUne platform
Status: Approved by the Managing Director and published. Version 1.0, effective 2026-10-14
Owner: Managing Director
Review cycle: at least annually

1. Classification levels

Level Description Examples
Public Intended for publication Marketing pages, public documentation
Internal Business information without personal data Product configuration, non-personal statistics
Confidential Customer business data and ordinary personal data Contacts, orders, invoices, employee records
Strictly confidential Credentials, authentication factors, payment data, special categories of personal data (Art. 9 GDPR, e.g. biometric voice or face data) Passwords, second-factor secrets, API keys, OAuth tokens, voice samples

All customer (tenant) data is treated as at least Confidential.

2. Classification in the platform (implemented)

  • The platform's central data catalogue marks entities with a personal-data level (none, low, high); this marking drives data-protection tooling such as exports and erasure planning. Coverage of the catalogue is being extended to all entities.
  • Password hashes and other secret fields are excluded from default query results.
  • Request data that is passed to error reporting is reduced to an allow-list of fields, and secrets in query strings are redacted.

3. Encryption in transit (implemented)

  • All public endpoints are served over HTTPS (TLS) at the service-mesh gateway; HTTP requests are redirected to HTTPS; certificates are issued by a public certificate authority and renewed automatically.
  • HTTP Strict Transport Security with a one-year max-age including subdomains.
  • Connections to the managed database service use TLS.
  • Webhooks from payment and other providers are verified with the providers' signatures.

4. Encryption at rest (implemented)

  • The database (MongoDB Atlas) and object storage (Google Cloud Storage) are hosted in Frankfurt, Germany, and encrypt all stored data and backups at rest by default (provider-managed AES-256).
  • Third-party credentials of tenants are additionally encrypted at application level with AES-256-GCM before storage. An optional end-to-end mode derives the key on the client (PBKDF2-SHA256, 600,000 iterations, AES-256-GCM) so that the server cannot decrypt the secret.
  • Passwords are stored only as bcrypt hashes.
  • Data exports for data subjects are stored encrypted and delivered via time-limited signed links.

5. Handling rules

  • Strictly confidential data must never be written to logs, tickets, chat messages or e-mails in clear text.
  • Confidential data may only be shared with sub-processors under data processing terms (individual agreements or the provider's standard data processing addendum).
  • Test and demonstration use only test data.

6. Planned improvements

  • Extend the personal-data marking to all entities of the data catalogue.
  • Migrate remaining older credential records to the current AES-256-GCM format.
  • Enforce mutual TLS for internal service-to-service traffic (planned; not yet enforced).

Work with this page

Ready-made instructions for your AI tool. Copy, paste, go — the AI fetches the content itself via the address in the text.

Summarise the steps for me The essentials, in the right order.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/data-classification-and-encryption-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Summarise the content for me.

- First, in two sentences: what is this about?
- Then the steps in the order I need to take them.
- One line per step, in plain language.
- At the end: what I should have ready beforehand.

Leave out nothing I need in order to actually finish.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Explain what I need this for What it is good for — and when it is worth it.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/data-classification-and-encryption-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Explain to me what I need this for.

1. Which problem does it solve? In one sentence, from my point of view.
2. Three typical situations in which it genuinely helps me.
3. When I do NOT need it — that saves me time.
4. What I can do instead if it is not a fit.

Stick to what the source says. Where it gives nothing, say so openly instead
of guessing.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Help me set this up Step by step, asking me as you go.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/data-classification-and-encryption-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Walk me through the setup step by step.

- First tell me what I need to have ready (access, data, time).
- Then take me through ONE step at a time. Wait for my "next".
- For each step, say how I can tell that it worked.
- If something goes wrong, ask me for the exact message instead of guessing.

If the instructions leave a point open, tell me so rather than inventing it.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Help me with a problem Narrow down the cause instead of guessing.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/data-classification-and-encryption-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Help me narrow down a problem.

- First ask me what I observe and what I expected instead.
- From that, derive the most likely causes consistent with this source.
- For each cause, give me ONE test that confirms or rules it out.
- Order them so the cheapest test comes first.

Do not guess. If the source does not cover the problem, tell me where I should
look next.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Explain it in plain words No jargon, from the ground up.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/data-classification-and-encryption-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Explain the content so that someone without prior knowledge understands it.

- Start with the purpose: why does this exist at all?
- Explain technical terms in half a sentence on first use.
- One everyday comparison where it genuinely holds — none where it limps.
- At the end: the three things worth remembering.

Do not shorten by dropping conditions. A simplification that hides a
prerequisite is a false statement.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
A checklist to tick off To follow along while you do it.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/data-classification-and-encryption-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Turn this into a **tick-off checklist** for practical use.

- Exactly one action per item, in the imperative.
- Order it so that no item depends on a later prerequisite.
- Prerequisites and pitfalls as indented sub-items.
- End with an acceptance step: how do I know everything is right?
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.

Was this article helpful?

👎 No (0)
Leave a comment