When this is the right conversation
A new SaaS platform, AI vendor or outsourcing arrangement will access business or personal information, but the procurement process has no consistent data review.
What the work involves
- Document intended data, purposes, systems, subprocessors and known processing locations.
- Collect the relevant contractual, technical and operational evidence without treating marketing claims as verification.
- Record gaps, owners, proposed mitigations and the decisions requiring counsel or security expertise.
- Prepare an exit and review plan that addresses exports, access removal, deletion evidence and changes over time.
What we need from your team
A procurement or business owner, the proposed use case and the vendor’s available documentation. The vendor’s cooperation affects the depth of review.
What useful completion looks like
The approval authority can see what is known, what is unverified, who owns each remaining issue and what the exit would involve.
We do not issue independent assurance reports, certify vendors or replace legal contract review or specialist security testing.
Before we begin
We agree the business objective, named delivery roles, access arrangements, fee, timetable and acceptance criteria in a written scope. Dependencies and out-of-scope work stay visible. We do not assume permission to change production systems or transfer sensitive information.
See the engagement processRelated field notes
Before the vendor demo becomes your data decision
Approve a use case—not a supplier in the abstract.
A team wants to trial a hosted document service. First describe which information would leave which system, for what purpose and for which users. Keep the supplier’s answer separate from its supporting evidence and your reviewer’s conclusion. A trial, a renewal and an expanded use can require different decisions.
Illustrative scenario, not a client case study or a claim of past results.
The working evidence
- Use-case boundaryData categories, source systems, recipients and intended feature use.
- Evidence worksheetSupplier statement, document or setting reviewed, date and scope.
- Open-question logUnresolved terms, processing locations, subprocessors and specialist reviews.
- Exit and change planReturn, access removal, termination steps and review triggers.
Who does what
The internal use-case owner sponsors the request. Procurement coordinates commercial evidence. Counsel reviews contractual and legal questions. Security and privacy specialists review their respective requirements. The authorised client role decides whether to proceed.
Present an approval brief that makes the permitted scope and unresolved matters obvious. Identify the evidence needed before a trial can expand. Revisit the decision when the purpose, dependency or relevant terms change.
A sales statement is not an independent assurance report; an assurance report is not a guarantee for your use case. This service does not certify a supplier or approve a data transfer on your behalf.
Make the first workshop useful.
Bring roles, questions and approved examples—not an unrestricted data export.
- What information would leave the organisation, for what purpose?
- Which contractual and operational questions require an evidenced answer?
- Who can approve the proposed use, and how would access and data return end?