Document Handling Policy

Why there is no upload button

This website deliberately accepts no file uploads. An unauthenticated web form that ingests commercial documents is an attack surface and an accountability gap: you cannot see where the file went, and neither can we prove it. Documents reach us by email reply instead, where the recipient address is visible to you, the thread is auditable by both sides, and nothing arrives before a human is engaged with your case.

A dedicated authenticated upload channel — with malware scanning, encrypted storage, access logging and deletion controls — is planned for a later phase. It will be announced here when it exists, not before.

What we ask you to send, and not send

• Useful: quotations, proforma invoices, payment instructions, supplier license copies, storefront screenshots, correspondence excerpts relevant to the review.
• Do not send: your own banking credentials or card details, passwords, government identity documents, or any document you are not authorized to share. If a review genuinely requires something sensitive, we will say so and agree the channel first.

How documents are used

Documents you provide are used solely to deliver the engagement you ordered: they are read, compared against registry records and other engagement materials, and cited in your report where relevant. They are not used for marketing, not shared with other clients, not sold, and not disclosed to the supplier under review except where you ask us to put a specific question that necessarily reveals a document you provided.

Storage and access

• Documents live in our engagement mailbox and working storage, access-restricted to the people working your case.
• Field representatives receive only the excerpts a visit requires — typically the checklist and the claims to test, not your full commercial file.
• We do not store your documents in the website’s hosting infrastructure at all; the site is static and has nowhere to put them.

Retention and deletion

• Documents from enquiries that do not become engagements: deleted within 90 days.
• Engagement documents: retained alongside the engagement record for the period commercial-record law requires of the operating entity, then deleted.
• On request, we delete provided documents earlier wherever a legal retention duty does not prevent it — write to [email protected].

If something goes wrong

If we become aware of unauthorized access to documents you provided, we will inform you without undue delay, tell you what was affected, and state what we are doing about it.

Related: the privacy notice covers personal data generally; this page governs commercial documents specifically. Questions: [email protected].