Data Classification

Data classification is governance metadata you attach to a Nullstone workspace to declare how sensitive the data it holds is. It is surfaced as color-coding in the UI, editable in the UI and in IaC, and fed into every Terraform run so the classification lands on your cloud resources as tags and labels.

Classification is available on every block type, but it is most valuable on datastores — the workspaces where data actually lives.

Data classification is governance metadata only. It does not enforce access controls, tenant isolation, or audit gating.

The sensitivity level

Classification is a single sensitivity level — an ordered ladder describing how sensitive the data is:

Level	Slug	Color
Public	public	🟢 green
Operational	operational	🔵 blue
Customer Content	customer-content	🟡 yellow
Restricted	restricted	🔴 red
Critical	critical	🟣 purple

Unclassified is a first-class state

The level is optional. A workspace with no level set is unclassified — nothing is silently defaulted, and no tag is emitted until you set a level. The governance views surface unclassified workspaces prominently so you can find and classify them.

Classify by contract, not by inspection

Classify a workspace based on what it is designed to hold, declared at provision time — not by scanning the data after the fact. A customer content database is customer-content because that is its purpose, regardless of whether it currently holds any rows.

Cloud tagging

When a sensitivity level is set, every Terraform run for the workspace emits it to the cloud as the composite value <#>-<slug> (e.g. 2-customer-content), which is valid across all four surfaces:

Surface	Key	Example value
AWS tag	DataClassification	2-customer-content
GCP label	dataclassification	2-customer-content
Azure tag	DataClassification	2-customer-content
Kubernetes label	nullstone.io/data-classification	2-customer-content

The composite value is readable in the cloud console and sortable/threshold-filterable in cost tooling. Any module that already spreads data.ns_workspace.this.aws_tags / .gcp_labels / .k8s_labels picks this up with no module changes; Azure modules adopt the azure_tags output.

Setting a classification

In the UI

Open a block's Settings tab and use the Data Classification section to set the sensitivity level. The classification is set on the block and applies identically to every environment.

In IaC

Declare metadata.dataclassification on any block in .nullstone/config.yml:

datastores:
  customer-db:
    module: nullstone/aws-rds-postgres
    metadata:
      dataclassification: customer-content
  feature-flags:
    module: nullstone/aws-dynamodb
    metadata:
      dataclassification: operational

See the IaC datastores reference for details.

Governance views

Nullstone provides filterable inventories to answer compliance questions:

• Stack-level — the Classification tab on a stack lists that stack's workspaces grouped/filterable by level, with an unclassified callout.
• Org-wide — a roll-up across every stack for the compliance/security persona.