Data Handling Statement

Clients in regulated sectors need to know exactly how their data is held before an engagement begins. This is our standing position; engagement agreements may tighten it further.

Data minimization

We ask for the least data required to complete the gate in progress. Where synthetic, redacted or sampled data will answer the question, we use it instead of production data.

Residency and hosting

Client data is held in the region agreed in the engagement, including Canada, the United States, the European Union, the United Arab Emirates and Australia. Where export-control or sovereignty rules apply, work is performed inside the client's own environment.

Access control

Access is least-privilege and named. Only engagement personnel with a current need are granted access, multi-factor authentication is mandatory, and access is revoked on role change or engagement close. Access events are logged.

Model and vendor use

Client data is not used to train models. Where third-party model providers are used, they are named in the engagement agreement, configured to disable training on submitted content, and covered by written data protection terms.

Sub-processors

We maintain a current list of sub-processors and provide it on request. Clients are given advance notice of changes and may object where the agreement provides for it.

Retention, return and deletion

Working data is deleted at engagement close unless a retention period is agreed. Deliverables and evidence packages are returned in an open format. On written request we provide confirmation of deletion.

Incidents

Suspected incidents affecting client data are assessed immediately and notified to the client contact without undue delay, with the facts known at the time, containment steps taken and a follow-up report.

Questions about this document? Contact RN Consultants Inc.