#POL-GL-501: Document Classification & Publication Policy

#Purpose

To decide, repeatably, what tier a document is published at, who approves publication, and what must be true before a document appears on the Trust Center at all.

---

#1. The classification test

A document is gated unless one of the following is positively true of it. Each is a positive finding, recorded against the document, and the finding is what places a document in the public tier. The absence of a reason to gate is not a finding and does not make a document public.

1.1 The public tier is short by design, and the openness is delivered as latency. A hospital cannot evaluate what it cannot read, and an unknown vendor cannot afford to be coy. Pensieve Labs answers that with a gate that opens in hours and never asks a sales question, and not with an open estate that serves contract templates, internal control policies and assurance evidence to anyone who arrives without saying who they are. The security whitepaper, the architecture overview, the sub-processor register, the DPA, the SLA, the standard MSA, the control policy set, the framework mappings and the assurance evidence are T_NDA: one click, an administrator grant, a four business hour target, and the latency printed on the lock. What used to be published is not withheld. It is dated, watermarked, and traceable to the person who asked for it, which is what makes it safe to hand over the sensitive parts at all.

1.2 No certification claims. Edsol Edtech Pvt. Ltd. holds no ISO/IEC 27001, SOC 2, HITRUST, CE or ARTG certification. No document may be published that states or implies otherwise. The Trust Center carries an Assurance & Evidence section, not a Certifications section. Where a control set is mapped to a standard, the correct form is: "controls are mapped to ISO/IEC 27001:2022 Annex A. Edsol Edtech Pvt. Ltd. is not certified to ISO/IEC 27001. The Statement of Applicability is published at …"

1.3 Nothing is published that has not been reviewed for the presence of another customer's information. A single hospital's name in a screenshot, log excerpt, sample report or example is a breach of confidentiality and of MSA-IN-001 clause 12. Examples use obviously fictional names.

1.4 Redaction is a version, not an edit. Where a T_NDA document has a publishable summary, the summary is a separate document with its own doc_id, its own tier and its own review date. A document is never served in two different forms from one identifier.

1.5 The public list, in full. The table below is the list, and no others. It carries twenty-one rows and twenty-two document identifiers, because POL-GL-500 and POL-GL-501 are one instrument published under two identifiers. The register must therefore show exactly twenty-two T_PUBLIC records. The Founder performs that reconciliation, at each review of this Policy under POL-GL-502 clause 1.2, which is twelve months for a K_POLICY, and on any trigger at POL-GL-502 clause 1.7, and records the count found in the change history below. Where a source file carries contains_doc_ids, every identifier in it is tested against this clause separately: one frontmatter tier emitting two register records is the control failure that published FRM-GL-509 unexamined. A document joins this list only by an amendment to this clause, approved by the Founder under Section 2 and recorded. A document that no longer satisfies the finding beside it leaves the list at the next review under POL-GL-502.

1.5.1 An application is not an admission. Several instruments across the estate record an amendment to this clause as a dependency of their own, in a dependency ledger or an equivalent table, and state that they are gated until it is made. Such a row is an application, not an amendment. It does not place the document on the list, it does not change the document's register record, and it is never read as making the document public. The list is only what the table below carries, and the only evidence that a document has joined it is a row in that table together with a change-history row recording the Founder's approval under Section 2. An author who finds a ledger row asserting that a document has been admitted must check the table; where the table does not carry the document, the document is not public and the ledger row is the thing that is wrong.

1.6 Which gate a document sits behind. Applied only after the test at the head of this Section has returned gated. Each row is a positive finding, recorded against the document.

1.7 T_NDA is the resting place of the estate, and that is deliberate. The clickwrap is the cheapest gate that produces a named, dated, enforceable record of who holds the document. It is what lets Pensieve Labs publish the sensitive material at all rather than write a thinner version of it. Where a reviewer needs a document faster than the four business hour target, POL-GL-500 clause 1.5 domain auto-approval exists precisely to take the administrator off the path.

---

#2. Publication workflow

2.1 Legal does not decide whether to publish a security bulletin. NTC-GL-021 Section 11 governs.

2.2 Every published document carries, on every page: doc_id, version, Last Modified On, tier, and, for the legal letterhead variant, the SHA-256 short hash and the verification QR resolving to https://trust.pensievelabs.org/verify/. SPEC-003 Section D.2.

2.3 A document is never silently changed. A change of substance is a new version with a change-history row. A typographical correction is a patch version and is still recorded.

2.4 Withdrawal. A withdrawn document keeps its doc_id, is marked Withdrawn with the date and the reason, and remains retrievable. Its successor is named. Trust centers that quietly delete documents are the reason buyers take their own copies.

---

#3. Marketing site consumption

All security, legal, privacy and compliance copy on https://pensievelabs.org is served from the Trust Center. The marketing site holds no separate copy and no separate version. Each document declares the marketing paths it feeds in source_of_truth_for. A marketing page that restates a Trust Center fact in its own words is a defect and is raised as one.

---

#4. Roles

---

#5. Compliance and enforcement

A document published at the wrong tier is re-tiered within 1 Business Day of discovery, the exposure is assessed, and the event is recorded in the Incident Register (REG-GL-203) where anything at T_CLIENT or above was exposed. Where another hospital's information was exposed, NTC-GL-002 applies.

---

#Related documents

#Change history