Purpose and minimisation
The data boundary starts with what the workflow needs and what it must never receive.
- Named source and purpose
- Least data required for the bounded task
- Sensitive-data exclusions defined before access
Trust record / Data
Data movement should be understandable before it is automated.
Sources, permitted use, providers, retention, deletion and export expectations are mapped for the specific workflow.
Data posturereviewed 19 August 2026
- Current posture
- This website offers direct email contact and a single contact form that delivers a message to the founder without a website database. Optional Google Analytics is consent-gated on production and absent from staging builds. No third-party CRM capture or marketing automation is active.
- Applies to
- The website or a specifically scoped engagement.
- What this cannot conclude
- A universal data-processing posture outside the website and a separately contracted engagement.
Operating detail
Data is recorded through concrete decisions.
The fields below describe the current method. Engagement-specific evidence and terms still have to be produced for the workflow in question.
Providers and regions
External processors and model providers are recorded for the engagement before production data is permitted.
- Provider terms and data use reviewed
- Location and transfer constraints mapped
- Material provider changes return to approval
Retention and exit
Retention is not assumed to be unlimited. Deletion, export and operational logs are proportionate to the agreed workflow.
- Retention window written in scope
- Deletion and export route assigned
- Handover records unresolved data obligations
Evidence request
Ask for the evidence behind the statement.
A procurement or technical question should name the control, workflow and evidence requested. The answer should state the current fact and the uncovered gap.
Data question recorddirect founder response
- Question
- The exact control, policy or evidence requested.
- Applies to
- The named workflow, system and engagement.
- Response
- Current fact, available evidence and any gap.
- What this cannot conclude
- That one scoped response covers another workflow, provider, environment or contract.