# Financial data policy

## Authorized local use

Agents may read every file in the Robopato repository and copy real financial
documents for local development, parser validation, migration, and compatibility
testing. This permission does not authorize committing that material or sending
it to external services.

Real financial data may exist only in ignored local directories and local
databases. Use these repository-root directories:

| Location | Purpose |
| --- | --- |
| `data/` | Local working data and database storage |
| `documents/` | Source documents copied from Robopato |
| `imports/` | Local import inputs and intermediate results |
| `uploads/` and `media/` | Application-managed local files |
| `exports/` | User exports and generated reports |
| `backups/` | Database and application backups |

Verify the destination with `git check-ignore` before copying financial data.
Keep local credentials in ignored `.env` files; `.env.example` may contain only
non-secret examples. Keep sensitive execution output out of shared transcripts.

## Git boundary

Never add real financial data to Git. This includes raw documents, database
dumps, copied excerpts, snapshots, logs, screenshots, generated reports, and
documentation containing identifying transaction data. Ignoring a file does
not remove data that was already tracked. Never use force-add to bypass this
policy.

Committed tests and examples must use synthetic or irreversibly sanitized data.
Use `tests/fixtures/synthetic/` for explicitly synthetic CSV, TXT, and PDF
fixtures. A fixture exception in `.gitignore` is not evidence that its contents
are safe. Sanitization must remove identifying information and prevent recovery
of the original sensitive data; changing a name alone is insufficient.

Before every commit, inspect `git diff --cached --name-only` and
`git diff --cached`, including newly added fixtures, for financial data and
secrets. When uncertain whether material is safe, stop and ask the owner.

## Runtime handling

Use separate least-privilege development and application database accounts.
Record actor, source, timestamp, and outcome for imports and material changes.
Treat audit records, errors containing source rows, and test output derived from
real documents as financial data. Use synthetic data for shareable diagnostics.

If sensitive material is accidentally tracked, stop propagation and notify the
owner. Do not push it or rewrite history without explicit authorization.