Working and Access Policies

Confidentiality

I use nonpublic information you share only to evaluate or perform our agreed work. That includes credentials, source code, business plans, customer information, and details about your clients. I do not disclose it to others without your permission, except to an approved person who needs it for the work, or when disclosure is legally required. I ask anyone I authorize to help me to protect it to the same standard. I do not publicize your name, your clients, or our work without permission.

Confidentiality does not cover information already public through no fault of mine, independently developed without your information, or lawfully received from someone allowed to share it. Our written agreement can address any special confidentiality or regulated-data requirements.

Accounts and access

You keep ownership and administrative control of your systems and accounts. Please grant only the access needed for the agreed work, preferably through a named individual account with the appropriate permissions and multifactor authentication. Use a secure sharing method for credentials; please do not send passwords in ordinary email or tickets. I do not share your credentials, place them in public repositories, or use them for another client or purpose. We will agree before any outside service or AI tool receives your nonpublic information.

I will use reasonable safeguards for access and information in my care. We will identify any required security controls, approved tools, and people allowed to access your environment in the written agreement. You can revoke access when it is no longer needed. When the engagement ends, I will stop using access, return or delete client materials as agreed, and cooperate with an orderly handover, subject to legal recordkeeping and agreed backup retention.

Security concerns

If I learn of unauthorized access, disclosure, or loss involving your information or access under my control, I will tell your designated contact promptly, share what I know, and cooperate on reasonable containment and investigation. We will document the notification channel and any specific response duties before handling sensitive or regulated data. Each party remains responsible for its own legal notification duties.

Agency relationships and independent work

I will not use an agency's confidential client information or access gained through our work to bypass that agency and solicit its clients for the same engagement. If a longer or more specific non-solicitation commitment is needed, we can define it in our written agreement. As an independent consultant, I may work with other agencies, competitors, and businesses in the same industry. I cannot agree to a general non-compete or an exclusive relationship unless we separately negotiate its scope and price.

Project terms

Each written engagement should identify the systems and services covered, authorized contacts, deliverables, schedule, fees, approvals for extra work or third-party costs, ownership and licenses, backup and security responsibilities, and how either party can end the work. A retainer, technical partnership, or monitoring package may have different service hours and capacity rules. Review the agency retainer policies or the technical engagement policies for those specific services.