Insights
Privacy and preparation
138 guides · page 3 of 3
Redaction tags, fake names or hashes: which replacement keeps data useful?
Redaction vs masking vs synthetic replacement for business records: how tags, fake names and hashes compare on readability, leak risk and usefulness.
Regex vs NER vs LLM redaction: which catches more PII in free text?
Regex vs NER vs LLM PII detection: each method catches different things. A decision matrix and a layered pipeline for redacting tickets, emails and notes.
RFIs and submittals: confidential and personal details to review
RFI and submittal confidentiality for AEC firms: a field review list for owner names, site addresses, security-sensitive drawings and subcontractor contacts.
Salary and compensation details in email and chat archives
Salary information confidentiality in email and Slack archives: which mailboxes and channels to exclude whole, and how to detect pay details elsewhere.
Salesforce data masking for preparing CRM exports
Salesforce Data Mask covers structured fields in a sandbox but misses notes, email bodies and files. A practical flow for preparing CRM exports for licensing.
Screenshots and attachments: the PII that text redaction misses
How to redact PII in screenshots, photos, PDFs and log files that text redaction never reads, with attachment types ranked by risk and a clear decision tree.
Secrets in Jira, Confluence and Slack: scanning beyond code
Secrets in Slack messages, Jira tickets and Confluence pages slip past code scanners. Where they hide, which tools reach them and how to rotate and remove.
Security questionnaire to send a data licensee (template)
A vendor security questionnaire template for companies licensing data: 25 questions on storage, access, training use, deletion and incident response.
Sell-side data room checklist: privacy and data documentation buyers now ask for
A sell-side data room checklist for the privacy and data folder: inventory, notice history, DPAs, incidents and the data rights acquirers' counsel ask about.
Sending the decryption key separately: safe key exchange for data deliveries
How to share an encryption key securely: send it by a different channel, to a separately verified person, for a limited time, using one of four methods.
Sensitive data consent under state privacy laws: when opt-in is required
Sensitive data consent under state privacy laws: which categories count, when opt-in is required, where they hide in business records, and why to exclude.
Sensitive personal information hiding in work records
Sensitive personal information examples mapped to where they hide in tickets, chats, HR files and dispatch records, and whether to exclude, redact or coarsen.
Service provider or third party: when a SaaS company cannot license customer data
Service provider vs third party under the CCPA: why a SaaS vendor usually cannot license customer data, and which of its own records it can license.
ServiceTitan exports: customer, technician and payment fields to review
A ServiceTitan data export holds customer, technician and payment fields to review before sharing. A field-by-field table by object for home services owners.
Share links and access tokens in records: the doors still open
Shared links in tickets, email and chats can still open files and accounts. Find anyone-with-the-link docs, reset links and signed URLs, then neutralize them.
Shipper, consignee and driver details in freight records
Freight data privacy for 3PLs, brokers and carriers: a TMS and WMS field map of which shipper, consignee and driver details to keep, transform or exclude.
Shipping data on encrypted hard drives: a step-by-step chain of custody
How to ship data on an encrypted hard drive: encrypt, hash, seal, log, send the key separately, verify on arrival, then return or destroy the drive.
Should de-identification happen before data leaves your systems?
Should you de-identify before sharing data? Compare doing it in your own systems, in a controlled processing environment or at the buyer, and when each fits.
Slack DMs and private channels: include or exclude from a data export?
Should Slack DMs and private channels go into a data export? The default is to exclude them. When a narrow inclusion is defensible, and what to document.
Spanish-language and multilingual records: why PII tools miss names
PII detection in non-English text misses Spanish names, double surnames and code-switched notes. A checklist for bilingual service records before any export.
Spoken numbers and spelled-out emails: why call transcript redaction misses them
Tools that redact PII from call transcripts often miss spoken digits, spelled-out emails and numbers split across turns. How to catch each leak pattern.
State privacy laws taking effect in 2026: what changes for B2B and employee data
New state privacy laws in 2026 from Indiana, Kentucky and Rhode Island: what they mean for business contacts, employee records and licensed data.
Subprocessors in a data licensing transaction: who touches your data
Subprocessors and data sharing in a data license: map every party from supplier to the licensee's vendors, and the contract controls to require at each link.
Supplier and customer names in NCRs and CAPAs
How to anonymize quality records before licensing: replace supplier and customer names in NCRs and CAPAs with codes, keep defect, cause, action and outcome.
The redaction log: documenting what was removed and how
A redaction log records what personal data was removed from a dataset, how, with which tools and versions, and what QA found. Fields, examples and pitfalls.
Unpatched vulnerabilities in issue trackers: exclude or keep?
Security vulnerabilities in Jira tickets need a firm rule before licensing: exclude open issues, review patched ones, and filter on these labels and fields.
Using Microsoft Purview to find sensitive data in SharePoint and OneDrive
Use Microsoft Purview sensitive information types and content explorer to map personal data in SharePoint and OneDrive and build an export inventory.
Warehouse labor and picker productivity data: employee privacy
Warehouse productivity monitoring privacy for picker and LMS data: aggregate to team or shift, remove operator IDs and check quota-law notices before reuse.
Website chat transcripts and CIPA wiretap lawsuits: safe to license?
CIPA chat wiretap lawsuits target website chat widgets. See how the claims work, what your old chat disclosures said, and how to scope chats for a license.
What counts as deidentified data under US state privacy laws?
The deidentified data definition most US state privacy laws share, where California differs, and the commitments and contract terms a data license needs.
What de-identification standard should a data license specify?
A de-identification standard in a contract should name the legal definition, methods, a residual limit, QA, a no re-identification promise and audit.
What metadata can you share in a fit check without sharing records?
Share metadata, not data: the system names, date ranges, field lists and volume bands a fit check needs, and what to hold back to protect clients and staff.
What not to redact: keeping product names, error codes and outcomes
Over-redaction strips the product names, error codes and outcomes that make support records useful. A field-by-field list of what to keep and what to remove.
What to bring to privacy counsel before a data licensing review
Privacy counsel data licensing checklist for CEOs: the record inventory, notice history, contracts, request logs and redaction plan to bring first.
Where personal data hides in a 200-person company: a system-by-system map
Where is personal data stored in a company? A system-by-system map of helpdesk, CRM, chat, email, ERP, HRIS, file shares and code, with a risk level for each.
Which privacy notice applied when? Versioning notices for old records
Build a privacy policy version history for old records: where past versions hide, how to date them, and how to map each one to the records it covered.
Which state privacy laws cover employee data?
Which state privacy laws cover employee data? California is the outlier. See how other states treat HR and work records, and what to keep out of a license.
Which state privacy laws exempt B2B contact data?
Most state privacy laws exempt people acting in a business role, but California does not. See how B2B contact data sorts before you license CRM records.
Who controls company data after a shutdown? Custody, access and security
Company data after closing a business still belongs to the entity. Learn who acts for it, how to lock down admin access and what to export first.
Why helpdesk redaction settings don't clean up old tickets
Helpdesk redaction settings usually apply to new tickets only. Why old tickets stay exposed, and a four-step plan to clean your historical exports safely.
Wiping laptops and servers in a wind-down without losing the records
Before you wipe company laptops for sale, preserve what only they hold. The safe order: inventory, export or image, verify, sanitize, then certify.
Zendesk redaction: what it removes and what it misses
Zendesk redaction removes chosen text and attachments from live tickets. What it leaves behind, and how to redact years of ticket history for licensing.