#Trust Center Access & Classification Policies

POL-GL-500 | Version 1.0.0 | Last Modified On 31 July 2026

---

#POL-GL-500: Trust Center Access Policy

#Purpose

To state who may see what in the Pensieve Labs Trust Center, on what basis, for how long, and how access is granted, refused, reviewed and withdrawn.

#Scope

https://trust.pensievelabs.org and everything published on it. Binds Edsol Edtech Pvt. Ltd. and every person who holds or requests a credential.

---

#1. Policy statements

1.1 The default tier is T_PUBLIC. A higher tier must be justified in writing against Section 2 of POL-GL-501 and recorded. A gate is not the safe choice; it is a choice with a cost. Pensieve Labs is an unknown vendor and every gate removes a day from a hospital's evaluation and adds one to T2C.

1.2 Five tiers, and no others.

1.3 A maximum of five active credentials per client hospital. Enforced in the database by a partial unique index, not by process. A sixth request triggers NTC-GL-508 and FRM-GL-509.

1.4 Access is granted to a person, never to a role, a shared mailbox or a distribution list. Requests from info@, admin@, it@ and equivalents are declined and redirected to a named individual, with the reason given.

1.5 Domain-based auto-approval. The administrator may configure auto-approval for the verified e-mail domain of an existing Customer or of a hospital with an executed NDA. Auto-approval:

1.5.1 applies to T_NDA and T_CLIENT only, never to T_INTERNAL; 1.5.2 is recorded per domain with the person who authorised it and the date; 1.5.3 does not lift the five-credential cap; 1.5.4 is reviewed at each access review under Section 4; 1.5.5 is removed automatically when the Customer's Agreement ends.

Auto-approval exists to take the administrator off the critical path. A hospital's security reviewer waiting overnight for a credential is a day of T2C spent on nothing.

1.6 Decision service level. Every access request receives a decision within one Business Day, and Pensieve Labs targets four business hours. A request that has not been decided within one Business Day is escalated to the Founder automatically.

1.7 Every request receives a reply. Approval (NTC-GL-505) or refusal (NTC-GL-506). Silence is not a decision. A refused requester is a future buyer and the refusal says what is available without a credential.

1.8 Grounds on which access is refused. Only these:

Not a ground: being a small hospital, being a consultant acting for a hospital, being a journalist, being a researcher, being a student, or being a person Pensieve Labs would rather not answer.

1.9 Duration.

1.10 Watermarking. Every document served at T_NDA and T_CLIENT carries a per-viewer watermark, baked into the PDF at render time. POL-GL-510 is the notice given to viewers.

---

#2. How a request is made and decided

---

#3. What the requester must supply, and what Pensieve Labs will not ask for

Required: name, work e-mail, organisation, role, and which documents or which subject they need.

Pensieve Labs does not require, as a condition of access: a phone number, a budget, a timeline, a purchase intent, a signed paper NDA where the clickwrap suffices, or a sales conversation. A trust center that extracts a sales qualification before showing a security document is a lead-capture form wearing a trust center's clothes, and hospital security reviewers recognise it immediately.

---

#4. Access review

---

#5. Revocation

5.1 Access is revoked when: the person leaves the hospital and the hospital tells Pensieve Labs or the credential fails a quarterly review; the Agreement ends and the Exit Period expires; a grant expires; the terms in POL-GL-052 or NDA-GL-002 are breached; a watermarked document is found outside its permitted audience (POL-GL-510); or the hospital asks.

5.2 Revocation is notified by NTC-GL-507, stating the ground, the date and the route to reinstatement. Revocation without notice is used only where notice would defeat its purpose, and notice follows within 2 Business Days.

5.3 Revocation does not delete the audit trail. Which documents that person accessed, and when, is retained under POL-GL-503.

---

#6. Exceptions

An exception to this Policy is granted only by the Founder, is recorded in the Exception & Waiver Register (REG-GL-210) with a reason and an expiry date, and is reviewed at expiry. An exception that lowers a tier is not an exception: it is the default under Section 1.1 and needs no waiver.

---

#POL-GL-501: Document Classification & Publication Policy

#Purpose

To decide, repeatably, what tier a document is published at, who approves publication, and what must be true before a document appears on the Trust Center at all.

---

#1. The classification test

A document is T_PUBLIC unless one of the following is true. Each is a positive finding, recorded against the document.

1.1 Publish more openly than the reference benchmark. Pensieve Labs publishes at T_PUBLIC, as a deliberate decision: the security whitepaper, the architecture overview, the sub-processor register, the DPA template, the SLA template, the standard MSA, the privacy policy, the deployment-model comparison, the vulnerability disclosure policy, the exit and portability commitment, and the security bulletins. The control-level policies, the assurance mappings and the detailed disclosures behind these summaries sit at T_NDA. A hospital cannot evaluate what it cannot read, and an unknown vendor cannot afford to be coy.

1.2 No certification claims. Edsol Edtech Pvt. Ltd. holds no ISO/IEC 27001, SOC 2, HITRUST, CE or ARTG certification. No document may be published that states or implies otherwise. The Trust Center carries an Assurance & Evidence section, not a Certifications section. Where a control set is mapped to a standard, the correct form is: "controls are mapped to ISO/IEC 27001:2022 Annex A. Edsol Edtech Pvt. Ltd. is not certified to ISO/IEC 27001. The Statement of Applicability is published at …"

1.3 Nothing is published that has not been reviewed for the presence of another customer's information. A single hospital's name in a screenshot, log excerpt, sample report or example is a breach of confidentiality and of MSA-IN-001 clause 12. Examples use obviously fictional names.

1.4 Redaction is a version, not an edit. Where a T_NDA document has a publishable summary, the summary is a separate document with its own doc_id, its own tier and its own review date. A document is never served in two different forms from one identifier.

---

#2. Publication workflow

2.1 Legal does not decide whether to publish a security bulletin. NTC-GL-021 Section 11 governs.

2.2 Every published document carries, on every page: doc_id, version, Last Modified On, tier, and, for the legal letterhead variant, the SHA-256 short hash and the verification QR resolving to https://trust.pensievelabs.org/verify/. SPEC-003 Section D.2.

2.3 A document is never silently changed. A change of substance is a new version with a change-history row. A typographical correction is a patch version and is still recorded.

2.4 Withdrawal. A withdrawn document keeps its doc_id, is marked Withdrawn with the date and the reason, and remains retrievable. Its successor is named. Trust centers that quietly delete documents are the reason buyers take their own copies.

---

#3. Marketing site consumption

All security, legal, privacy and compliance copy on https://pensievelabs.org is served from the Trust Center. The marketing site holds no separate copy and no separate version. Each document declares the marketing paths it feeds in source_of_truth_for. A marketing page that restates a Trust Center fact in its own words is a defect and is raised as one.

---

#4. Roles

---

#5. Compliance and enforcement

A document published at the wrong tier is re-tiered within 1 Business Day of discovery, the exposure is assessed, and the event is recorded in the Incident Register (REG-GL-203) where anything at T_CLIENT or above was exposed. Where another hospital's information was exposed, NTC-GL-002 applies.

---

#Related documents

#Change history