Working With Client Data Under an NDA
Consultants, auditors and contractors receive other people’s data constantly, under terms that were signed months earlier and skim-read once. The clauses that matter are usually the ones about who else may see it.
What confidentiality terms usually restrict
The specifics vary, but most agreements cover the same ground:
- Disclosure to third parties. Often absolutely, sometimes with a named-and-approved exception list.
- Where processing may happen. Named jurisdictions, or the client’s own systems only.
- Retention. Delete on request, or by the end of the engagement.
- Subcontractors and subprocessors. Frequently requiring prior written approval.
- Return or destruction of all copies at the end.
How an online tool breaches these quietly
Uploading a client file to a web service is a disclosure to a third party. It is also a subprocessor you did not get approved, in a jurisdiction you did not check, with a retention policy you did not read, keeping copies you cannot destroy on request.
Four clauses, one drag-and-drop, and nobody involved intended to breach anything. That is what makes it dangerous: it does not feel like disclosure. It feels like opening a file.
A workflow you can actually defend
- Keep the file where it already is — on your encrypted machine, in the folder covered by your engagement.
- Analyse it locally. Open the tool, drop the file in, and query it with SQL. The file is read into your browser’s memory and nothing is transmitted.
- Aggregate before you share. Export the summary you need, not the row-level extract.
- Close the tab. The in-memory copy is gone. Nothing is written to local storage or cookies.
- Delete the source when the engagement ends, as your agreement requires.
At no point does a third party enter the chain, so there is nothing extra to disclose, approve or certify.
What to tell a client who asks
Plain, checkable statements work better than assurances:
- “Your files are processed on my machine, in the browser. They are not uploaded to any service.”
- “No third party receives your data, so there are no additional subprocessors to approve.”
- “Nothing is retained by the tool. It holds data in memory only, for as long as the tab is open.”
- “You can verify this yourself in a minute — open the Network tab and watch it stay empty, or disconnect from the internet and watch it keep working.”
That last one is the one that lands. It is a demonstration rather than a claim. The verification method is written up here, and you can send that link.
Query client files without adding anyone to the chain.
Open the tool →Handling several clients at once
You can load up to 26 files and join across them — but be deliberate about whose data sits in the same tab. Keeping one client per browser session is a small discipline that prevents the accident where a join accidentally combines two clients’ records into one export.
If the client wants more than assurances
Some clients — banks, hospitals, government — will want documentation rather than a conversation. Two things are available: a self-contained build you or they can host internally, and a signed statement that the build makes no network requests after load, with SHA-256 checksums for every file. Both are available on request.