Data Governance & Access Policy

Purpose

This policy defines guardrails for access to OCV data by individuals working on Pulse, with a focus on minimizing exposure of sensitive information while enabling efficient product development.

Scope

Applies to all individuals contributing to Pulse, including:

• Full-time employees (FTEs)
• Contractors and subcontractors
• Advisors or external engineering resources

This policy also applies to automated systems that access OCV data on a person's behalf, including AI agents, coding assistants, and analytics or reporting jobs. A non-human identity is subject to the same access rules as the person or service it acts for.

Data Classification

For purposes of this policy, Sensitive Data includes (non-exhaustive):

• Investor or entity identifiers (e.g. EINs)
• Portfolio company financials (compensation, equity ownership)
• Personally identifiable information (PII)
• Any production data tied to real investors, portfolio companies, or employees
• Portfolio company banking and transaction data, and the credentials or tokens used to access it (financial account connection tokens, account metadata, balances, and transaction records)
• Internal commentary, qualitative assessments, ratings, scores, or rankings about founders, individuals, companies, or deals
• Production secrets and credentials of any kind
• Production logs and error traces, which routinely contain the above

Default Access Rules

1. AI Model Data Access Policy

   1. AI access is bounded by the requesting user's own permissions. An AI system must not return to a user any data that user could not access directly. Broad model access to company and portfolio information is permitted, but retrieval is filtered to the requester's entitlements at query time.
   2. The following data categories are explicitly excluded from AI access:

      1. Internal commentary or qualitative assessments about founders or individuals
      2. Internal ratings, scores, or rankings assigned to companies or deals
      3. Personally identifiable information (PII)
      4. Banking credentials, financial account tokens, and production secrets
   3. When in doubt about whether information falls into a restricted category, default to excluding it from AI access and flag for review
   4. Approved AI providers only. AI systems processing OCV Sensitive Data must run under an enterprise agreement that contractually excludes OCV data from provider model training and provides for zero or limited retention. Approved providers are listed in the Control Register. Consumer-tier or personal accounts must not be used with OCV data.
   5. Outputs inherit classification. An AI-generated summary, ranking, or analysis derived from Sensitive Data is itself Sensitive Data, and is subject to the same handling and sharing restrictions.
2. Production Access

   1. Access to production systems and live OCV data is restricted to FTEs only by default.
   2. Non-FTE access to production systems or sensitive data is prohibited unless explicitly approved as an exception.
   3. "Production access" means any of the following, and each is granted separately rather than as a bundle:

      1. read access to production databases or data stores
      2. write or administrative access to production databases or data stores
      3. access to the Google Cloud console or project
      4. access to production logs, error tracking, or observability tooling
      5. access to production secrets, credentials, or tokens
      6. the ability to deploy to production
   4. Read access to production logs and error tracking is treated as production data access, not as a lesser tier.
3. Exception Handling

   1. Exceptions may be granted on a case-by-case basis where there is a strong business or technical justification and a demonstrated trust relationship.
   2. Exceptions must be explicitly documented and approved by OCV leadership.

      1. Every exception must record: who, what specific access, business justification, compensating controls, approver, and a mandatory expiry date of no more than 90 days. Exceptions expire automatically and must be re-approved to continue. An exception without an expiry date is not valid.
   3. Exceptions should be reviewed monthly at the first Automation Meeting of the month.
4. Offboarding and Engagement End

   1. All Pulse access is revoked within one business day of an FTE's termination or a contractor's engagement ending. This includes repository access, cloud access, production access, credential vault entries, and any AI tooling provisioned for the engagement.

Contractor & Subcontractor Engagement Model

Where technically feasible, contractors and subcontractors may contribute to Pulse without access to OCV Sensitive Data, under the following guardrails:

1. Data Isolation

   1. Contractors must work exclusively in:

      1. Non-production environments (e.g., dev, staging)
      2. Environments populated with synthetic, anonymized, or scrubbed data
   2. No direct or indirect access to live production data.
2. Principle of Least Privilege

   1. Access is limited strictly to the systems, services, and repositories required to perform assigned tasks.
3. Technical Controls

   1. Use of feature flags, mock services, or API contracts to decouple development work from real data.
   2. Prohibition on copying, exporting, or locally storing any OCV data unless explicitly authorized.
4. Process & Oversight

   1. All contractor work scoped and reviewed by an OCV FTE owner or a specific designate.
   2. No unsupervised access to infrastructure, credentials, or deployment pipelines tied to production.
5. Legal & Compliance

   1. All contractors are required to sign the We Start The Company consulting agreement which includes a provision on Confidential Information and an addendum on the Protection of Data.
   2. Violations of this policy may result in immediate access revocation and termination of engagement.
   3. Flow-down. A contractor engaging a subcontractor on Pulse work must obtain OCV's written approval, and the subcontractor must be bound to equivalent obligations. Subcontractors are recorded in the access register by name.
   4. Advisors and external engineering resources are in scope of this policy and must be bound by a confidentiality agreement with equivalent data protection terms before receiving any access, whether or not they sign the standard consulting agreement.

Guiding Principle

OCV’s default posture is to design Pulse such that meaningful engineering work can be done without exposure to sensitive OCV data. Direct access to production data is treated as exceptional, not foundational, to development velocity.