# Data Classification Hook

Fires on every inbound request. Tags sensitivity level using structured pattern detection.

## Configuration

Add to your `.claude/settings.json`:

```json
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Read|Bash",
        "command": "sh .claude/hooks/classify-data.sh $FILE_PATH"
      }
    ]
  }
}
```

## Classification Levels

| Level | Description | Examples |
|-------|-------------|----------|
| **Public** | No sensitivity | Marketing copy, public docs |
| **Internal** | Business internal | Internal processes, team notes |
| **Confidential** | Sensitive business data | Financial reports, strategy docs |
| **Restricted** | Regulated / PII | SSNs, credentials, deal terms |

## What It Catches (Structured Patterns)
- Social Security Numbers (XXX-XX-XXXX)
- Credit card numbers (Luhn-valid patterns)
- API keys and tokens (known prefixes)
- Email addresses in bulk
- Account numbers

## What It Flags for Human Review
- Names and addresses in natural language
- Financial terms embedded in prose
- Contextual PII that regex can't reliably detect

## Key Principle
This is the first pass — structured pattern detection. It catches the high-signal, automatable patterns. Contextual classification requires human judgment or a dedicated review step.