Sensitive data, handled like it matters.

At scoping we agree how your data will be handled and put it in the engagement, so nobody has to rely on a website. That covers:

• where the data is processed and stored, and in which region
• who has access, and to what
• how long raw exports are kept
• who to contact, and what happens, if something goes wrong

CIMS, SRS and the other systems you use stay exactly where they are. Finished reports are published to your own SharePoint and Power BI, where your existing permissions decide who sees them.

We ask for the narrowest access that does the job. Anyone else who joins a project only gets access once you’ve approved them and their confidentiality agreements are signed.

At handover you get a list of who has access to what, so you can remove anything that’s no longer needed.

How long raw exports are kept is set for each project. In one current pipeline, which runs on cloud servers we manage in the Oceania region, raw exports are deleted as soon as each report is checked and published, and only the latest three releases are kept so a bad release can be rolled back.

Where a client wants every figure traceable to its original file, the originals are kept instead, inside the storage agreed for that project.

The reports we build count and compare: how many people were supported, which programmes they used, what changed over time. They’re made for managers, boards and funders, not for reading individual case notes.

Checks run before each release, so a problem stops the update instead of reaching the report.

We don’t claim certifications or blanket compliance we can’t show you. If your board, funder or IT provider needs specific policies, a data-flow diagram or answers to a security questionnaire, ask at scoping. We’ll say plainly what’s in place and what would need to be added.

Tell us which systems hold the data and who needs the reports, and we’ll explain how we’d handle it. Please don’t send client or case details through the contact form.