How we handle confidential documents

Before documents are shared

Start with a brief description of the work and your confidentiality requirements. The public website form is for initial inquiries. Do not send tender pricing, identity documents, financial records or passwords through it.

Before you send confidential documents, we sign an NDA and agree why the information is needed, who may access it and how files will be exchanged. Tender pricing and technical submissions follow the same arrangements.

Identify the records the work needs

The scope determines which documents are needed. Share the relevant records through the agreed route.

• Company registration: ownership, identity and company papers.
• Vendor registration: credentials, personnel evidence and supporting records.
• ISO support: management-system documents and relevant evidence.
• Tender preparation: technical and commercial submissions, including pricing.
• Bookkeeping and filing: financial records and relevant employee or supplier details.

Access during the work

Much of our work is delivered in-house. We agree who may access information for the engagement; any outside contractor signs an NDA. Submissions to buyers, authorities or certification bodies follow the agreed scope and your approval. For tenders, you can submit yourself or authorize us to submit; you receive a copy of the completed tender either way.

Keybridge uses Element X for end-to-end encrypted internal communication. Our CRM and internal systems are hosted locally. Two-factor authentication is required on Keybridge systems used for client work.

Erbil is our main branch. Helsinki does not handle client work or client documents.

Our boundary for AI

We use LLMs only with public or non-private information. Internal, secure and private client documents are never uploaded to LLMs.

The website’s external AI links open a generic public prompt. Do not add confidential client information to those external conversations.

Handover and document retention

Storage and retention arrangements must be confirmed in writing for the engagement. They should cover what is returned, what must be retained and why, when access ends, and how working copies and backups are handled.

Our standard retention schedule is published in Privacy. Any required exception and the handling of working copies, backups and provider-held records must be addressed for the engagement. We do not promise immediate deletion from every system. See Privacy for personal-data handling and requests, and Website terms for engagement boundaries.