Before sharing files
Do not send private source documents through a public enquiry or unapproved inbox. Agree a confidential transfer route, permitted tools, processing locations and review responsibilities before a production assignment.
Onboarding requirements
Define named accounts, MFA, restricted access, device protection, approved storage and backups, permitted people, retention and an incident contact. These are assignment requirements to verify during onboarding, not a claim of independent security certification.
Source and restricted information
Preserve the approved source, track instructed changes and keep private material out of public samples. Do not trade, tip or reuse material non-public information. A public final filing does not make its unpublished source or private comments public.
AI and external tools
Confidential material must not be processed through an external AI or consumer conversion service without express client authorization and appropriate vendor terms. The creation of website marketing content is not permission to process a client’s private files.
People and continuity
Any reviewer, subcontractor or backup operator who accesses client information needs appropriate authorization, confidentiality commitments and limited access. Identify actual review ownership rather than implying a staffed internal team that has not been agreed.
Incidents and closeout
An engagement should define containment, evidence preservation, designated notification contacts and contractual notification timing. Retention and deletion are agreed separately. No universal response time or country-exclusive processing promise is made.