Policy CL-44 · External-Party Name Retention

⚠ 自动 redaction 倒计时

下次 CL-44 sweep: 2026-05-18 00:00 UTC (今天往后约 16 小时)。任何在那之前未被 Legal 显式 verify 的外部第三方姓名都会被 Workplace 系统全局替换为 [external · redacted]，无法回滚。

⚠ Auto-redaction countdown

Next CL-44 sweep: 2026-05-18 00:00 UTC (~16 hours from now). Any external third-party name not explicitly verified by Legal before that timestamp will be globally replaced across Workplace surfaces with [external · redacted]. The change is not reversible.

这条政策是什么

CL-44 来自 2025 Q2 安全审计后的合规需求。Tema 员工在 Workplace 上提到的任何 未与公司有正式关系 的外部姓名 (记者、监管人员、未签 MNDA 的客户对接人、外部研究人员、前员工的家人, 等)，在被首次提及后 7 天 内必须满足以下任一条件之一才能继续留存:

1. Legal 已为这个人 issue 一个 EXT-VERIFIED-NNNN token (通常意味着已经签了 NDA 或者属于公开 PR 名单)。
2. 这个名字出现在 IR (investor relations) 维护的「公开新闻」白名单。
3. 提名员工已正式申请该名字的 retention 豁免，并被 Anika Halberstam 批准。

不满足任一条件的，到 7 天截止时会被自动 redact。redact 是 不可逆的：原始字符串从所有索引、缓存、screenshot OCR layer、邮件 DLP audit、内部搜索引擎里同步替换为 [external · redacted]。

为什么要这么做

表面动机：合规、防止员工在内部不慎曝光外部接触；防止外部姓名被竞品挖走。

实际效果 (legal team 内部 memo 摘要)：让任何 潜在的吹哨人 在内部 ping 到「我可能想联系外面这个记者」之后只有非常短的窗口实际去做；7 天一过，那条线索本身就在系统里消失了，未来任何同事都看不到这个名字曾经被提过。

— 该效果在 2025-09 由 Compliance L4 提议加入 CL-44 v3.4 修订；2025-11 由 SVP Engineering 批准。

What the policy is

CL-44 was introduced as a compliance requirement after the 2025 Q2 security audit. Any external name without a formal relationship with the company (journalists, regulators, customer contacts without an MNDA, external researchers, family members of former staff, etc.) mentioned by a Tema employee on Workplace must, within 7 days of first mention, meet one of:

1. Legal has issued an EXT-VERIFIED-NNNN token for that person (typically meaning an NDA was signed or the person is on the public PR list).
2. The name appears on the IR (investor relations) "public news" allow-list.
3. The mentioning employee has filed a retention waiver for that name and Anika Halberstam has approved it.

If none of these are satisfied by day 7, the name is auto-redacted. The redaction is not reversible: the literal string is replaced with [external · redacted] across all indexes, caches, screenshot OCR layers, mail DLP audit, and the internal search engine, all in one sweep.

Why we do it

Surface rationale: compliance, preventing inadvertent exposure of external contacts, preventing competitors from poaching external names mentioned internally.

Actual effect (per a Legal team internal memo): any potential whistleblower who pings internally about wanting to reach an outside journalist has only a very short window to actually do so; after 7 days that lead disappears from the system, and no future colleague will see the name was ever mentioned.

— This effect was proposed by Compliance L4 in 2025-09 as part of CL-44 v3.4; approved by SVP Engineering 2025-11.