# TowerOps Policies

Company policies governing code quality, security, privacy, and operations.

## Policies

| Policy | Description |
|--------|-------------|
| [Elixir Code Standards](ELIXIR_CODE_STANDARDS.md) | Idiomatic Elixir patterns, naming, testing, and formatting requirements |
| [Security & Vulnerability Prevention](SECURITY_AND_VULNERABILITY.md) | Pre-commit security checklist, dependency auditing, vulnerability response |
| [User Privacy](USER_PRIVACY.md) | Data classification, multi-tenant isolation, retention, export/deletion |
| [Incident Response](INCIDENT_RESPONSE.md) | Severity levels, response procedures, communication, post-mortems |
| [Change Management](CHANGE_MANAGEMENT.md) | PR process, deployment procedures, database migration safety |
| [Data Handling & Retention](DATA_HANDLING.md) | Encryption, backups, data processing, disposal, access controls |

## Enforcement

These policies are enforced through:

1. **CI/CD** — Automated checks (formatting, credo, sobelow, dialyzer, tests)
2. **Code review** — Required for all PRs
3. **Quarterly reviews** — Policies reviewed and updated as the product evolves