Security starts before the first file is sent
A useful analysis rarely requires the entire history of a business. Start by defining the management question, then keep only the columns, periods and documents needed to answer it.
This minimisation reduces handling, speeds up the work and limits exposure if something goes wrong. Direct identifiers — names, email addresses, phone numbers or customer references — should be removed or pseudonymised whenever they are not essential.
A short, traceable and closed circuit
Business files should not travel through a long email chain that nobody fully controls. A private upload area, a time-limited link and tightly scoped permissions make the process explicit: who sent the files, who can view them and when access ends.
- Encrypt data in transit and at rest.
- Grant each person only the access required for the task.
- Log important actions without recording sensitive content.
- Set a retention period and a deletion procedure.
The final report is part of the security perimeter
A final report can contain confidential information too. It should be delivered through a controlled channel with a reasonable access period, rather than as a permanent email attachment. Charts reused for marketing must go through a separate anonymisation step.
For a small-business leader, the key question is not only ‘where are my files?’ but ‘what is their complete lifecycle?’. A sound answer covers upload, analysis, delivery, any backup and final deletion.
The simple check to run with every provider
Before sharing a dataset, ask who can access it, where it is stored, for how long, how an incident would be handled and how deletion is verified. These answers do not replace tailored legal advice, but they quickly expose an opaque process.
