as4-411/docs/adr/004-sensitive-data-classification.md

ADR-004: Sensitive Data Classification and Encryption

Status

Accepted.

Context

The directory holds mixed sensitivity data: public identifiers (BIC, LEI), internal endpoints and participant data, and confidential or regulated data (MID/TID, contract routing, key references). We need a clear classification and enforcement policy so that storage and access controls are consistent and auditable.

Decision

• Four tiers: Tier 0 (public), Tier 1 (internal), Tier 2 (confidential), Tier 3 (regulated/secrets). See data-classification.md for definitions and examples.
• Enforcement: Field-level encryption for Tier 2+ at rest; strict RBAC/ABAC; immutable audit logs for mutations and Tier 2+ access. Tier 3: only references (e.g. vault_ref) stored; no private keys or tokens in the directory.
• Mapping: All tables and fields used for directory and routing artifacts are mapped to a tier. New fields require a tier before merge. Per-tenant encryption keys for Tier 2+ are recommended (see ADR-003).

Consequences

• Operators and developers have a single reference for how to handle each data type. Compliance and security reviews can align on tier and controls.