Security
What to know before sharing material.
Data handling starts with the scope of the engagement. The portal implementation described here does not establish the safeguards of an AI provider, your own systems, or a production service. Confirm access, storage, and retention arrangements before sharing material.
What we ask for, and what we do not want
Start with relevant screenshots, exported settings, or policy documents rather than a complete data export. Do not send passwords, API keys, administrator credentials, production secrets, or customer records. This is sharing guidance, not a claim that uploads are automatically screened for secrets.
Private portal storage and authorized downloads
The portal implementation uses private storage for evidence and deliverables. It checks authorization before issuing a signed download link valid for 60 seconds. A signed link can be used by someone who has it until it expires; it is not a single-use or named-recipient link.
Who can access a project
Portal access follows organization membership and staff project assignments. Platform administrators can access all projects. Agree the people and access needed for your engagement before adding material.
Evidence retention is scoped, not assumed
The portal implementation includes a scheduled process to remove committed evidence files and their records after an organization-specific retention period. This does not cover every record, deliverable, comment, account, or backup. Production operation has not been verified, so this describes an implementation capability, not a deletion deadline. Retention and handover arrangements must be confirmed during scoping.
Examples on this site
The sample packages use invented material. They do not contain client documents or measured client results, and they are not evidence of a completed client engagement.