Client Data Handling Policy

During a project we often work with a client's real business information — staff lists, client records, documents, and credentials. This policy sets out how that information is handled.

Commitments

• Client data is used only for the agreed engagement — never for our own purposes, and never sold or shared
• Access is limited to the people working on the engagement
• Credentials are stored in secure credential storage, not in plain documents or chat threads
• Realistic test data is anonymised or minimised where practical
• Client data leaves our possession at the end of an engagement: returned, migrated, or deleted as agreed
• Confidentiality survives the end of the engagement

Client ownership

The client's data remains the client's property throughout. Systems are built so clients are not locked in: data can be exported in usable formats, and handover includes the access needed to remain in control of their own system.