Standards

Privacy & Security Principles

SMB diligence can involve tax returns, bank activity, payroll, customer data, contracts and other highly sensitive information. The public website should not be treated as a transaction data room.

Minimize public intake

Initial forms should request only the high-level context needed to understand the transaction. Sensitive seller or buyer records should move through an appropriate secure process after scoping.

Use controlled access

Transaction files should be limited to people who need them for the engagement and handled through systems appropriate to the sensitivity of the information.

Do not claim certifications that do not exist

Security certifications, encryption guarantees or compliance regimes should be stated only when they are actually implemented and verified.

Separate content from client records

Public educational data and private engagement records should not be blended casually for marketing or research.

Escalate unusual sensitivity

Regulated personal data, health information, payment data or other sensitive categories may require additional procedures or specialist review.

The right security statement is the strongest one the actual process can support, not the strongest one marketing can write.