#POL-GL-501: Document Classification & Publication Policy

#Purpose

To decide, repeatably, what tier a document is published at, who approves publication, and what must be true before a document appears on the Trust Center at all.

---

#1. The classification test

A document is T_PUBLIC unless one of the following is true. Each is a positive finding, recorded against the document.

1.1 Publish more openly than the reference benchmark. Pensieve Labs publishes at T_PUBLIC, as a deliberate decision: the security whitepaper, the architecture overview, the sub-processor register, the DPA template, the SLA template, the standard MSA, the privacy policy, the deployment-model comparison, the vulnerability disclosure policy, the exit and portability commitment, and the security bulletins. The control-level policies, the assurance mappings and the detailed disclosures behind these summaries sit at T_NDA. A hospital cannot evaluate what it cannot read, and an unknown vendor cannot afford to be coy.

1.2 No certification claims. Edsol Edtech Pvt. Ltd. holds no ISO/IEC 27001, SOC 2, HITRUST, CE or ARTG certification. No document may be published that states or implies otherwise. The Trust Center carries an Assurance & Evidence section, not a Certifications section. Where a control set is mapped to a standard, the correct form is: "controls are mapped to ISO/IEC 27001:2022 Annex A. Edsol Edtech Pvt. Ltd. is not certified to ISO/IEC 27001. The Statement of Applicability is published at …"

1.3 Nothing is published that has not been reviewed for the presence of another customer's information. A single hospital's name in a screenshot, log excerpt, sample report or example is a breach of confidentiality and of MSA-IN-001 clause 12. Examples use obviously fictional names.

1.4 Redaction is a version, not an edit. Where a T_NDA document has a publishable summary, the summary is a separate document with its own doc_id, its own tier and its own review date. A document is never served in two different forms from one identifier.

---

#2. Publication workflow

2.1 Legal does not decide whether to publish a security bulletin. NTC-GL-021 Section 11 governs.

2.2 Every published document carries, on every page: doc_id, version, Last Modified On, tier, and, for the legal letterhead variant, the SHA-256 short hash and the verification QR resolving to https://trust.pensievelabs.org/verify/. SPEC-003 Section D.2.

2.3 A document is never silently changed. A change of substance is a new version with a change-history row. A typographical correction is a patch version and is still recorded.

2.4 Withdrawal. A withdrawn document keeps its doc_id, is marked Withdrawn with the date and the reason, and remains retrievable. Its successor is named. Trust centers that quietly delete documents are the reason buyers take their own copies.

---

#3. Marketing site consumption

All security, legal, privacy and compliance copy on https://pensievelabs.org is served from the Trust Center. The marketing site holds no separate copy and no separate version. Each document declares the marketing paths it feeds in source_of_truth_for. A marketing page that restates a Trust Center fact in its own words is a defect and is raised as one.

---

#4. Roles

---

#5. Compliance and enforcement

A document published at the wrong tier is re-tiered within 1 Business Day of discovery, the exposure is assessed, and the event is recorded in the Incident Register (REG-GL-203) where anything at T_CLIENT or above was exposed. Where another hospital's information was exposed, NTC-GL-002 applies.

---

#Related documents

#Change history