Trust Is the Foundation of This Practice
Here is how client information is handled.
Confidentiality
- All client information is treated as confidential by default
- I sign NDAs before receiving sensitive materials
- Client names and details are never shared without explicit consent
Data Handling
- Client data is never sold or monetised; client names and details are never shared without explicit consent
- Engagement working materials are deleted within 30 days of engagement close unless SOW, NDA, legal hold, or procurement requirement specifies otherwise
Security Practices
- Controls mapped to SOC 2 TSC — documentation available under NDA
Engagement Model
- Direct engagement with Jan Cichocki (no subcontracting without explicit written client approval)
- Clear scope and deliverables defined in SOW
Security Measures
- Breach notification as required by applicable law
- Controls mapped to SOC 2 TSC — documentation available under NDA
- NDA-first engagement — I sign before receiving sensitive materials
Full technical details in the Privacy Policy §10. Additional documentation available under NDA.
Data Retention
I distinguish between two categories of information:
Client Working Materials
Decks, datasets, meeting notes, drafts, and other sensitive working documents shared during an engagement.
Deleted within 30 days of engagement close unless an SOW, NDA, legal hold or procurement requirement specifies otherwise.
Engagement Records
Contracts, invoices, SOWs, and compliance documentation required for business and regulatory purposes.
Retained per legal/regulatory requirements (typically 7 years).
Full retention schedule in the Privacy Policy §9.
Need Security Documentation?
For procurement teams and security reviews, I provide additional documentation under NDA, as part of the procurement packet: security questionnaire responses, a certificate of insurance, and control-mapping documentation.
View Procurement Packet → Security Questionnaire → Request Security Materials →Procurement Pathways
Pick the entry point that matches your procurement workflow.
Security Questionnaire
SIG Lite, SIG Core, CAIQ v4, CSA STAR, or your custom template — completed by me personally within 5 business days of NDA + scope confirmation.
View questionnaire workflow →Procurement Packet
Full procurement-side overview: data handling, retention, controls summary, and what is — and is not — attested.
View procurement packet →Request Materials
COI, DPA, NDA templates, subprocessor disclosure, or any other procurement artifact — submit a tailored request.
Submit a request →Compliance & Standards
Questionnaires
Available upon request
Certificate of insurance
In the NDA procurement packet
DPA
Where applicable
Subprocessors
Disclosed per engagement
About the control mapping: Controls are mapped to SOC 2 Trust Service Criteria. I do not claim third-party attestation or certification. Documentation is available under NDA where applicable.