Files are used only to deliver the agreed audit and are not sold, used to train a model, published or shared with another customer. Access is limited to the people performing the work.
Working copies of logs and configuration evidence are deleted within 30 days after report delivery, or earlier on written request, unless retention is required to resolve an active dispute. Invoices and essential transaction records may be retained where legally required.
Sanitised excerpts or case studies are used only with separate written permission. Declining permission does not affect the audit.