Data Classification and Encryption Policy

Classification

Public: content and product links intentionally published in creator guides or company pages. Internal: non-public operating documents and routine business information. Confidential: creator contact details, private videos, account records, support requests, and earnings data. Restricted: passwords, access and refresh tokens, application secrets, encryption keys, and sensitive identity or financial documents. Unclassified personal data must be treated as Confidential until assessed.

Handling and access

Confidential and Restricted information must be limited to authorized purposes and people with a business need. It must not be placed in public repositories, public links, or diagnostic output. Test data must be synthetic or appropriately de-identified wherever possible. Public publication must be intentional; a product's public facts do not make a creator's private earnings or credentials public.

Encryption requirements

Personal data and other Confidential or Restricted data must be encrypted in transit using TLS 1.2 or later and at rest using AES-128 or stronger, or an approved equivalent. This applies to databases, object storage, backups, exports, and company devices. Application passwords must use one-way password hashing. Platform tokens stored by Linkhaus are encrypted by the application in addition to applicable storage protections.

Encryption keys and application secrets must be access-controlled, excluded from source control, and rotated after suspected exposure. The owner must verify provider encryption documentation and configuration for every relevant storage and transfer path; this policy alone does not certify those settings.

Lifecycle and review

The owner must maintain a data inventory identifying classification, purpose, location, access, retention, and deletion arrangements. Temporary copies must be removed when no longer needed. Review is required annually and when a new data type, provider, or processing purpose is introduced.