Privacy & security
You approve the terms. Rights and privacy are reviewed before any records are shared. Here is exactly how that works, including its limits.
Before anything is shared
01 Your controls
What’s shared, how it may be used, how long it’s kept and what you’re paid are set out in a written agreement you approve first.
Pick the systems, date ranges and folders. Leave out any client, project or department you’d rather keep private.
Client agreements, confidentiality obligations and industry rules are checked for anything that limits what can be licensed.
Names, email addresses and company names are swapped for consistent stand-ins, so the work still reads clearly but no one can be identified.
Account numbers, tax IDs, passwords and access codes are removed. Legal correspondence, HR and payroll matters are excluded entirely.
De-identification lowers risk; it doesn’t erase it. That’s why scope is yours to set, and why nothing is final until you sign.
Kept intact so the work still makes sense.
Replaced, removed or excluded before delivery.
02 De-identification
Blacking out names makes records unreadable and worth less. Consistent stand-ins protect people while keeping the story intact.
Every person, client and vendor gets one invented name, used everywhere they appear: email, chat, files and systems. The work still reads clearly, and the connections that make records valuable survive.
Tax IDs, account and card numbers, phone numbers, addresses, passwords, API keys and one-time codes are stripped out, including from file names and spreadsheet columns.
Legal correspondence, HR and payroll matters, personal tax records and bank statements are left out entirely, along with anything you choose to exclude.
Free text is swept for names, signatures and secrets, then reviewed again. Findings feed back into the rules before anything is final.
Before
Luis, the March invoice from Kestrel Supply (INV-20419) is $1,240 over the PO. Their rep, Tom Baker, says it’s a fuel surcharge. Can you confirm before we pay from the Chase account ending 4471?
After
Sam, the March invoice from Vendor-7C1 (INV-20419) is $1,240 over the PO. Their rep, Chris Moore, says it’s a fuel surcharge. Can you confirm before we pay from the [bank account removed]?
03 Rights first
The records need to be yours to license. Anything that limits that is found early, and it shapes the scope.
Confidentiality terms with clients, customers and partners that limit how records may be used.
Duties like client confidentiality for professionals, and categories such as tax return or health information that carry their own rules.
Obligations that apply to personal information in your records, depending on whose information it is and where they are.
Some tools’ terms limit how exported data may be used. Those are checked before a system is put in scope.
This isn’t legal advice. We flag what we find and encourage you to have your own counsel review the scope and the final license. See how this plays out in your industry.
04 The license
Protection doesn’t end when records are delivered. These are the terms we negotiate for.
05 Straight talk
De-identification lowers risk. It doesn’t erase it. An unusual detail mentioned in passing, or context that only an insider would recognize, can occasionally survive even careful review.
That’s why sensitive categories are excluded entirely rather than cleaned, and why you set the scope and can leave out anything you’re unsure about.
It’s also why nothing is final until you sign. If the residual risk doesn’t sit right with you, you can walk away.
06 Questions
Have a specific concern? Ask us directly. We’d rather talk it through than have you guess.
Protecting people comes first. Names and contact details are replaced, sensitive identifiers are removed, sensitive categories are excluded entirely, and you decide what is in scope. Rights and privacy are reviewed before any records are shared.
That risk is why scope is yours to set. People and companies are replaced with stand-ins, sensitive categories are excluded, and you can leave out any channel, client or period you are unsure about. Permitted uses are also limited in writing.
No. A license grants defined, limited rights to use selected records for agreed purposes. You keep ownership of your records, your systems and your business.
Not to start. Any access or export needed to prepare records is defined in the agreement you approve, limited to the agreed scope and set up with you. Nothing is collected before then.
Often, yes, but it depends on your client agreements, confidentiality obligations and the rules in your industry. That is why rights are reviewed before any records are shared. Some records may need to stay out, and some businesses will not be a fit.
Start here
A conversation is all it takes to start. No files or login details needed.
