← Ataski · Trust & security · DPA · Subprocessors

Approved 2026-10-08

Asset Management Policy

Owner: the founder. Approved: 2026-10-08. Review: annually, and on any significant change — a new server, service, account or device.

1. What counts as an asset

Anything that stores or processes Customer Data, holds a credential, or can change production: the application server, the managed services, the vendor and developer accounts, the domain, the code repository, and the founder's devices. Libraries are not inventoried here — they are pinned in uv.lock and scanned under vulnerability-management.md.

2. Rules

1. Every asset is in docs/security/asset-inventory.md, with its owner, the class of data it holds (information-security.md §5: Customer Data, operational data, credentials) and where it is documented.
2. An asset is added in the same change that brings it into use — the same rule the sub-processor list follows (vendor-management.md §2). A vendor that processes Customer Data is also a sub-processor and is added there.
3. Every asset has one owner. Today that is the founder for all of them.
4. Use follows acceptable-use.md; access follows access-control.md.
5. An asset is retired under media-disposal.md, and the retirement is recorded in the inventory's disposal log.

3. Review

The inventory is re-checked at the quarterly access review — the same sitting walks the consoles and the server, so it is the natural moment to notice an asset that is missing or no longer used — and in full once a year.

4. Not in place today

• No automated discovery or CMDB. The inventory is kept by hand; at this size, one page is easier to keep true than a tool.
• No device management (MDM) on the founder's laptop and no remote wipe. Its encryption and screen lock are required by acceptable-use.md §1 and attested by the founder, not verified by a tool.
• No asset tags or serial-number register for hardware.
• First issue. The inventory was first written on 2026-10-08; it has not yet been through a quarterly review.