Security and Sensitive-Information Policy

Last updated: 2026-08-23

This policy governs what may and may not be committed to this repository, and under what conditions. Most of it is standard practice for any private corporate repository; the one genuinely unusual part is the governed exception below, which every custodian of this repository needs to understand before touching company/legal/immigration/.

Contents

• Repository Classification
• Prohibited Content
• Preferred Storage
• Corporate Records
• Personal and Immigration Records
• Access Control
• AI Use
• Accidental Secret or Sensitive-Data Commit
• Sharing Documents Externally
• Security Review Checklist

Repository Classification

This repository is a private internal corporate repository. Private status reduces exposure, but it does not make the repository an appropriate password vault or unrestricted personal-record archive.

Prohibited Content

Do not commit passwords; MFA codes or recovery codes; API tokens, access tokens, or private keys; CRA sign-in credentials; banking usernames or passwords; full payment-card details; full Social Insurance Numbers; security-question answers; or signing certificates or encryption secrets.

Preferred Storage

Use a reputable password manager for credentials and sensitive access instructions. Repository references should record only non-secret metadata, for example:

## CRA My Business Account

- Primary account holder: Arva Yusuf Ezzi
- Credential location: Corporate vault in password manager
- MFA owner: Arva Yusuf Ezzi
- Last access review: YYYY-MM-DD

Corporate Records

Government filings, signed resolutions, share certificates, and tax correspondence may be stored in this private repository when necessary to maintain the corporate record. Before upload: confirm the repository remains private, confirm the document belongs to the corporation, use a clear filename and permanent folder, and retain the authoritative original outside GitHub when prudent.

Personal and Immigration Records — governed exception

The default policy for a repository like this one would be to exclude personal immigration evidence entirely — store only corporate records and business-plan material, and keep the rest in a separate secure system. This repository departs from that default: the full C11 VisaAffix case docket, including passport scans, a marriage certificate, bank statements, paystubs, and educational and employment records for both Arva Yusuf Ezzi and Srinivasa Vijay Bhushan Panangipally, is stored in company/legal/immigration/.

Access Control

Keep the repository private — a hard requirement given the exception above, not merely a preference. Grant access only to individuals with a current business need. Do not grant broad access to a CPA, lawyer, consultant, or AI tool by default; provide only what is needed. Review collaborators and connected applications at least annually, remove access promptly when an engagement ends, and enable strong MFA on every GitHub account with access to this repository.

AI Use

AI assistants may help organize, summarize, and draft repository content, but original records remain authoritative, generated legal or tax documents must not be treated as professional work product without review, and an AI should not be given secrets through prompts or committed files. Given the exception above, an AI assistant working in this repository should treat company/legal/immigration/ with particular care — it’s appropriate to reference its existence and high-level facts, but its detailed contents (specific figures, document numbers) shouldn’t be reproduced into other documents without a clear reason.

Accidental Secret or Sensitive-Data Commit

If prohibited data is committed: remove it from the current branch immediately, assume the secret is compromised, rotate or revoke the credential, assess whether Git history must be rewritten, review connected logs and access, and document the incident without reproducing the secret.

Sharing Documents Externally

Before sharing a repository file: confirm the recipient and the intended purpose, provide the minimum necessary material, redact unrelated personal information, use a secure transfer method for tax, banking, ownership, or identity records, and never make the repository public as a shortcut.

Security Review Checklist

Review at least annually: repository visibility (must remain private); GitHub collaborators and connected applications; MFA status; whether the immigration-document exception is still needed (once the C11 matter is fully closed, consider whether the docket should move to a separate secure system); password-manager ownership and recovery arrangements; and advisor access that should be removed.