Privacy & security

Your records. Your terms.

You approve the terms. Rights and privacy are reviewed before any records are shared. Here is exactly how that works, including its limits.

Request a free consultation Read the full method

01 Your controls

Six protections built into every license.

Nothing moves without your signature
What’s shared, how it may be used, how long it’s kept and what you’re paid are set out in a written agreement you approve first.
You choose what’s in scope
Pick the systems, date ranges and folders. Leave out any client, project or department you’d rather keep private.
Rights reviewed up front
Client agreements, confidentiality obligations and industry rules are checked for anything that limits what can be licensed.
People replaced, not just blacked out
Names, email addresses and company names are swapped for consistent stand-ins, so the work still reads clearly but no one can be identified.
Sensitive material stays out
Account numbers, tax IDs, passwords and access codes are removed. Legal correspondence, HR and payroll matters are excluded entirely.
Straight talk about risk
De-identification lowers risk; it doesn’t erase it. That’s why scope is yours to set, and why nothing is final until you sign.

What makes records valuable

Kept intact so the work still makes sense.

The sequence of work, from request to result
Decisions and the reasoning behind them
Dates, statuses, roles and amounts
Procedures, templates and checklists

What never leaves as-is

Replaced, removed or excluded before delivery.

Names and contact details of people, clients and vendors
Bank and card numbers, tax IDs and other identifiers
Passwords, API keys and one-time codes
Legal correspondence, HR, payroll and personal tax records

02 De-identification

Replace the people. Keep the work.

Blacking out names makes records unreadable and worth less. Consistent stand-ins protect people while keeping the story intact.

Consistent stand-ins
Every person, client and vendor gets one invented name, used everywhere they appear: email, chat, files and systems. The work still reads clearly, and the connections that make records valuable survive.
Identifiers and credentials removed
Tax IDs, account and card numbers, phone numbers, addresses, passwords, API keys and one-time codes are stripped out, including from file names and spreadsheet columns.
Sensitive categories excluded
Legal correspondence, HR and payroll matters, personal tax records and bank statements are left out entirely, along with anything you choose to exclude.
Multiple review passes
Free text is swept for names, signatures and secrets, then reviewed again. Findings feed back into the rules before anything is final.

Illustrative exampleInvented names and details. Not real data.

Before

From: Dana Whitfield <dana.whitfield@harborlinefreight.com>
To: Luis Ortega

Luis, the March invoice from Kestrel Supply (INV-20419) is $1,240 over the PO. Their rep, Tom Baker, says it’s a fuel surcharge. Can you confirm before we pay from the Chase account ending 4471?

After

From: Maya Reyes <maya.reyes@company-a.example>
To: Sam Patel

Sam, the March invoice from Vendor-7C1 (INV-20419) is $1,240 over the PO. Their rep, Chris Moore, says it’s a fuel surcharge. Can you confirm before we pay from the [bank account removed]?

People and companies get the same stand-in everywhere they appear, so threads still connect.
Amounts, dates and document numbers stay, because they carry the meaning of the work.
Account details are removed outright.

03 Rights first

What’s reviewed before buyers are approached.

The records need to be yours to license. Anything that limits that is found early, and it shapes the scope.

Client agreements and NDAs
Confidentiality terms with clients, customers and partners that limit how records may be used.
Professional and industry rules
Duties like client confidentiality for professionals, and categories such as tax return or health information that carry their own rules.
Privacy laws
Obligations that apply to personal information in your records, depending on whose information it is and where they are.
Software and platform terms
Some tools’ terms limit how exported data may be used. Those are checked before a system is put in scope.

This isn’t legal advice. We flag what we find and encourage you to have your own counsel review the scope and the final license. See how this plays out in your industry.

04 The license

Terms that protect you after delivery.

Protection doesn’t end when records are delivered. These are the terms we negotiate for.

Read about the terms that matter

Use limited to the purposes in the license, such as training or testing AI systems
No attempts to re-identify people or companies
Limits on how long records are kept, and deletion when the term ends
Security and confidentiality requirements for how records are handled
Your approval of the final scope before anything is delivered

05 Straight talk

Honest about the limits.

De-identification lowers risk. It doesn’t erase it. An unusual detail mentioned in passing, or context that only an insider would recognize, can occasionally survive even careful review.

That’s why sensitive categories are excluded entirely rather than cleaned, why you set the scope and can leave out anything you’re unsure about, and why you can ask to see a de-identified sample before anything is delivered.

It’s also why nothing is final until you sign. If the residual risk doesn’t sit right with you, you can walk away.

06 Questions

About privacy and rights.

Have a specific concern? Ask us directly. We’d rather talk it through than have you guess.

Will my clients’ or employees’ information be exposed?

Protecting people comes first. Names and contact details are replaced, sensitive identifiers are removed, sensitive categories are excluded entirely, and you decide what is in scope. Rights and privacy are reviewed before any records are shared.

How records are protected →

Could something in our records embarrass us later?

That risk is why scope is yours to set. People and companies are replaced with stand-ins, sensitive categories are excluded, and you can leave out any channel, client or period you are unsure about. Permitted uses are also limited in writing.

Do I lose ownership of my records?

No. A license grants defined, limited rights to use selected records for agreed purposes. You keep ownership of your records, your systems and your business.

Will you need access to our systems?

Not to start. Any access or export needed to prepare records is defined in the agreement you approve, limited to the agreed scope and set up with you. Nothing is collected before then.

Am I allowed to license my business records?

Often, yes, but it depends on your client agreements, confidentiality obligations and the rules in your industry. That is why rights are reviewed before we approach buyers. Some records may need to stay out, and some businesses will not be a fit.

Your records. Your terms.

Six protections built into every license.

Nothing moves without your signature

You choose what’s in scope

Rights reviewed up front

People replaced, not just blacked out

Sensitive material stays out

Straight talk about risk

What makes records valuable

What never leaves as-is

Replace the people. Keep the work.

Consistent stand-ins

Identifiers and credentials removed

Sensitive categories excluded

Multiple review passes

What’s reviewed before buyers are approached.

Client agreements and NDAs

Professional and industry rules

Privacy laws

Software and platform terms

Terms that protect you after delivery.

Honest about the limits.

About privacy and rights.

Let’s talk about what you’ve built.