Policies

The parent document. Asset inventory, data protection in transit and at rest, network security, patching, logging, backup and recovery, and incident response.

Zero trust access architecture, centralized identity management, multi-factor requirements, least privilege, periodic access reviews, and revocation.

What is stored, for how long, how deletion works, and the point at which deleted data has aged out of every backup copy.

What the public site and the self-hosted applications collect, who it is shared with, and what is deliberately not collected.