Confidentiality and data
Discretion is a design property here - not a favour, and not a certification.
This page describes what already holds true in public, what a first conversation actually needs, and which confidentiality terms belong in the written agreement rather than assumed from a marketing page.
What crosses, and what does not
Draw the line before the first conversation, not after.
- Environment pattern
- Broad shape, tools, and request families - enough to test fit.
- Client identity, in early conversations
- Not needed. Patterns are enough until a written scope is underway.
- Credentials, tenant exports, recovery codes
- Never appropriate in a marketing form or first conversation, at any stage.
- Authorized access, once agreed
- Follows the same purpose, authorization, and revocation lifecycle as any other access decision.
Confidentiality boundary
Some of this is already true. The rest is a written-agreement question.
Already true, in public
- No partner directory, logo wall, or case study is published on this site.
- Early conversations use patterns, not client records, by design.
- Whether to disclose the arrangement to a client is the partner's decision, not a default.
A written-agreement question
- The specific confidentiality or NDA terms that apply to your firm.
- Data location and residency expectations for your environment.
- Retention and destruction of any material after an engagement ends.
- Breach-notification responsibilities and timelines.
Common questions, answered honestly
Short answers now; specifics in the agreement.
| Question | Honest short answer |
|---|---|
| Do you sign an NDA? | Confidentiality terms are negotiated directly in the partner agreement - not assumed from a published page, and not withheld either. |
| Where is data handled? | Data-location expectations are a qualification input your firm should state explicitly, not a default asserted here. |
| Who else might see our client's information? | Only people with a defined, authorized role in the qualified lane - named in the access plan, not left implicit. |
| Can we require specific handling terms? | That is exactly what qualification and the written agreement are for. |
Why this matters more than it sounds
A partner's discretion is only as good as the delivery side's habits.
Confidentiality is not a clause you can bolt on after a careless conversation. It has to be the default posture of every early exchange, or the written agreement is just cleaning up a habit that already exists.
Review the access lifecycle behind this →
See how baseline findings map to Law 25 and PIPEDA questions →
Bring a pattern. Leave the records out.
That single habit, kept from the first conversation onward, is most of what confidentiality actually requires day to day.