PublicProof AcademyWorking document
Reviewed Sep 9, 2026
Secure Document Handling Policy
How you handle other people\u2019s information. Write it before a client asks, not after something goes wrong.
If you hold client records, logins, or anything with a name and a number on it, you need a written answer to "how do you keep that safe". This is that answer. Some professions are required to have one; everybody benefits from having one.
| Business | [] |
|---|---|
| Responsible person | [NAME AND ROLE] |
| Effective date | [] |
| Next review | [at least once a year] |
1. What we hold
| Type of information | Where it lives | Who can see it | How long we keep it |
|---|---|---|---|
| [e.g. client contact details] | [] | [] | [] |
| [] | [] | [] | [] |
| [] | [] | [] | [] |
| [] | [] | [] | [] |
2. What we will not hold
Decide this deliberately. The safest record is the one you never collected.
- [e.g. Social Security numbers, unless a filing requires it]
- [e.g. full card numbers, ever]
- [e.g. medical or patient records]
- []
3. Access
- Every person has their own login. Nobody shares an account.
- Passwords live in [NAME YOUR PASSWORD MANAGER], never in a spreadsheet, a note, or a message.
- Multi-factor authentication is on for [email, banking, the CRM, file storage, and anything holding client data].
- Access is removed the same day someone leaves. Checklist owner: []
4. Devices
- Every device that touches client data is [password or biometric locked, encrypted, and set to lock after NUMBER minutes].
- Personal devices [may / may not] be used for client work. If they may, the same rules apply.
- Public wifi is [not used for client work / used only through a VPN].
5. Sending and sharing
- Client documents are shared by [METHOD], not as open email attachments.
- We confirm the recipient before sending anything containing personal information.
- Links we share expire after [NUMBER] days.
6. Keeping and destroying
| Record | Kept for | Then |
|---|---|---|
| [] | [] | [securely deleted / shredded] |
| [] | [] | [] |
| [] | [] | [] |
Paper is shredded, not binned. Drives are wiped or destroyed before disposal.
7. Backups
Client data is backed up [how often] to [where]. We test a restore [how often]. A backup nobody has ever restored from is not a backup.
8. If something goes wrong
- Contain it. Change the credential, disconnect the device, stop the sharing.
- Write down what happened, when it was noticed, and what was affected. Use the incident report.
- Tell [RESPONSIBLE PERSON] the same day.
- Find out whether notification is legally required in your state and for your profession, and act on that answer. Do not guess.
- Fix the cause, not just the symptom, and note the change here.
9. People
Everyone who works with client data reads this policy before their first day and signs below. It is reviewed with the whole team [how often].
Name, signature and date
Name, signature and date
Before you use this: This is a working starting point, not legal, tax, or insurance advice. Read every line, replace every bracketed field, delete what does not apply to you, and have anything you are unsure about reviewed by a qualified professional in your state before you sign it or send it to a customer.