#Trust Center Access & Classification Policies

POL-GL-500 | Version 2.2.0 | Last Modified On 29 August 2026

---

#POL-GL-500: Trust Center Access Policy

#Purpose

To state who may see what in the Pensieve Labs Trust Center, on what basis, for how long, and how access is granted, refused, reviewed and withdrawn.

#Scope

https://trust.pensievelabs.org and everything published on it. Binds Edsol Edtech Pvt. Ltd. and every person who holds or requests a credential.

---

#1. Policy statements

1.1 The public tier is a closed list, not a default. T_PUBLIC is never reached by the absence of a reason to gate. A document is public only where the test at Section 1 of POL-GL-501 positively places it there, and the resulting list is short, enumerated in full at POL-GL-501 clause 1.5, and reconciled against the register at every review under POL-GL-502. Everything else opens on request. A gate is still a choice with a cost, and it is not the safe option: Pensieve Labs pays that cost down in latency rather than in publication. The clickwrap is one click, the decision target is four business hours, the latency is printed on the lock itself, and no sales qualification is asked for at any point (Section 3). An unknown vendor cannot afford to make a hospital's reviewer wait. It can afford to make the wait short, and to say in advance exactly how short.

1.2 Five tiers, and no others.

1.3 A maximum of five active credentials per client hospital. Enforced in the database by a partial unique index, not by process. A sixth request triggers NTC-GL-508 and FRM-GL-509.

1.4 Access is granted to a person, never to a role, a shared mailbox or a distribution list. Requests from info@, admin@, it@ and equivalents are declined and redirected to a named individual, with the reason given.

1.5 Domain-based auto-approval. The administrator may configure auto-approval for the verified e-mail domain of an existing Customer or of a hospital with an executed NDA. Auto-approval:

1.5.1 applies to T_NDA and T_CLIENT only, never to T_INTERNAL; 1.5.2 is recorded per domain with the person who authorised it and the date; 1.5.3 does not lift the five-credential cap; 1.5.4 is reviewed at each access review under Section 4; 1.5.5 is removed automatically when the Customer's Agreement ends.

Auto-approval exists to take the administrator off the critical path. A hospital's security reviewer waiting overnight for a credential is a day of T2C spent on nothing.

1.6 Decision service level. Every access request receives a decision within one Business Day, and Pensieve Labs targets four business hours. A request that has not been decided within one Business Day is escalated to the Founder automatically.

1.7 Every request receives a reply. Approval (NTC-GL-505) or refusal (NTC-GL-506). Silence is not a decision. A refused requester is a future buyer and the refusal says what is available without a credential.

1.8 Grounds on which access is refused. Only these:

Not a ground: being a small hospital, being a consultant acting for a hospital, being a journalist, being a researcher, being a student, or being a person Pensieve Labs would rather not answer.

1.9 Duration.

1.10 Watermarking. Every document served at T_NDA and T_CLIENT carries a per-viewer watermark, baked into the PDF at render time. POL-GL-510 is the notice given to viewers.

---

#2. How a request is made and decided

---

#3. What the requester must supply, and what Pensieve Labs will not ask for

Required: name, work e-mail, organisation, role, and which documents or which subject they need.

Pensieve Labs does not require, as a condition of access: a phone number, a budget, a timeline, a purchase intent, a signed paper NDA where the clickwrap suffices, or a sales conversation. A trust center that extracts a sales qualification before showing a security document is a lead-capture form wearing a trust center's clothes, and hospital security reviewers recognise it immediately.

---

#4. Access review

---

#5. Revocation

5.1 Access is revoked when: the person leaves the hospital and the hospital tells Pensieve Labs or the credential fails a quarterly review; the Agreement ends and the Exit Period expires; a grant expires; the terms in POL-GL-052 or NDA-GL-002 are breached; a watermarked document is found outside its permitted audience (POL-GL-510); or the hospital asks.

5.2 Revocation is notified by NTC-GL-507, stating the ground, the date and the route to reinstatement. Revocation without notice is used only where notice would defeat its purpose, and notice follows within 2 Business Days.

5.3 Revocation does not delete the audit trail. Which documents that person accessed, and when, is retained under POL-GL-503.

---

#6. Exceptions

An exception to this Policy is granted only by the Founder, is recorded in the Exception & Waiver Register (REG-GL-210) with a reason and an expiry date, and is reviewed at expiry. An exception that publishes a document outside the closed list at POL-GL-501 clause 1.5 is the exception this Section exists to control, and it is granted only as an amendment to that clause. Raising a tier above T_NDA on a positive finding under clause 1.6 is not an exception and needs no waiver.

---

#POL-GL-501: Document Classification & Publication Policy

#Purpose

To decide, repeatably, what tier a document is published at, who approves publication, and what must be true before a document appears on the Trust Center at all.

---

#1. The classification test

A document is gated unless one of the following is positively true of it. Each is a positive finding, recorded against the document, and the finding is what places a document in the public tier. The absence of a reason to gate is not a finding and does not make a document public.

1.1 The public tier is short by design, and the openness is delivered as latency. A hospital cannot evaluate what it cannot read, and an unknown vendor cannot afford to be coy. Pensieve Labs answers that with a gate that opens in hours and never asks a sales question, and not with an open estate that serves contract templates, internal control policies and assurance evidence to anyone who arrives without saying who they are. The security whitepaper, the architecture overview, the sub-processor register, the DPA, the SLA, the standard MSA, the control policy set, the framework mappings and the assurance evidence are T_NDA: one click, an administrator grant, a four business hour target, and the latency printed on the lock. What used to be published is not withheld. It is dated, watermarked, and traceable to the person who asked for it, which is what makes it safe to hand over the sensitive parts at all.

1.2 No certification claims. Edsol Edtech Pvt. Ltd. holds no ISO/IEC 27001, SOC 2, HITRUST, CE or ARTG certification. No document may be published that states or implies otherwise. The Trust Center carries an Assurance & Evidence section, not a Certifications section. Where a control set is mapped to a standard, the correct form is: "controls are mapped to ISO/IEC 27001:2022 Annex A. Edsol Edtech Pvt. Ltd. is not certified to ISO/IEC 27001. The Statement of Applicability is published at …"

1.3 Nothing is published that has not been reviewed for the presence of another customer's information. A single hospital's name in a screenshot, log excerpt, sample report or example is a breach of confidentiality and of MSA-IN-001 clause 12. Examples use obviously fictional names.

1.4 Redaction is a version, not an edit. Where a T_NDA document has a publishable summary, the summary is a separate document with its own doc_id, its own tier and its own review date. A document is never served in two different forms from one identifier.

1.5 The public list, in full. The table below is the list, and no others. It carries twenty-one rows and twenty-two document identifiers, because POL-GL-500 and POL-GL-501 are one instrument published under two identifiers. The register must therefore show exactly twenty-two T_PUBLIC records. The Founder performs that reconciliation, at each review of this Policy under POL-GL-502 clause 1.2, which is twelve months for a K_POLICY, and on any trigger at POL-GL-502 clause 1.7, and records the count found in the change history below. Where a source file carries contains_doc_ids, every identifier in it is tested against this clause separately: one frontmatter tier emitting two register records is the control failure that published FRM-GL-509 unexamined. A document joins this list only by an amendment to this clause, approved by the Founder under Section 2 and recorded. A document that no longer satisfies the finding beside it leaves the list at the next review under POL-GL-502.

1.5.1 An application is not an admission. Several instruments across the estate record an amendment to this clause as a dependency of their own, in a dependency ledger or an equivalent table, and state that they are gated until it is made. Such a row is an application, not an amendment. It does not place the document on the list, it does not change the document's register record, and it is never read as making the document public. The list is only what the table below carries, and the only evidence that a document has joined it is a row in that table together with a change-history row recording the Founder's approval under Section 2. An author who finds a ledger row asserting that a document has been admitted must check the table; where the table does not carry the document, the document is not public and the ledger row is the thing that is wrong.

1.6 Which gate a document sits behind. Applied only after the test at the head of this Section has returned gated. Each row is a positive finding, recorded against the document.

1.7 T_NDA is the resting place of the estate, and that is deliberate. The clickwrap is the cheapest gate that produces a named, dated, enforceable record of who holds the document. It is what lets Pensieve Labs publish the sensitive material at all rather than write a thinner version of it. Where a reviewer needs a document faster than the four business hour target, POL-GL-500 clause 1.5 domain auto-approval exists precisely to take the administrator off the path.

---

#2. Publication workflow

2.1 Legal does not decide whether to publish a security bulletin. NTC-GL-021 Section 11 governs.

2.2 Every published document carries, on every page: doc_id, version, Last Modified On, tier, and, for the legal letterhead variant, the SHA-256 short hash and the verification QR resolving to https://trust.pensievelabs.org/verify/. SPEC-003 Section D.2.

2.3 A document is never silently changed. A change of substance is a new version with a change-history row. A typographical correction is a patch version and is still recorded.

2.4 Withdrawal. A withdrawn document keeps its doc_id, is marked Withdrawn with the date and the reason, and remains retrievable. Its successor is named. Trust centers that quietly delete documents are the reason buyers take their own copies.

---

#3. Marketing site consumption

All security, legal, privacy and compliance copy on https://pensievelabs.org is served from the Trust Center. The marketing site holds no separate copy and no separate version. Each document declares the marketing paths it feeds in source_of_truth_for. A marketing page that restates a Trust Center fact in its own words is a defect and is raised as one.

---

#4. Roles

---

#5. Compliance and enforcement

A document published at the wrong tier is re-tiered within 1 Business Day of discovery, the exposure is assessed, and the event is recorded in the Incident Register (REG-GL-203) where anything at T_CLIENT or above was exposed. Where another hospital's information was exposed, NTC-GL-002 applies.

---

#Related documents

#Change history