Casual Conversation
The ‘interesting project’ story at a conference that includes one detail too many. Our rule is simple: client work is never anecdote material.
Home / Confidentiality
About · Confidentiality
Your information stays yours.
Validation work runs on secrets: batch records, formulas, supplier names, deviation histories, customer lists. You can't fix what you won't show us — so we make it safe to show us. This page states exactly how we protect client information, before you share a single document.
WHY IT MATTERS
You can't validate what you can't see.
The most useful engagements are the most open ones. Confidentiality isn't a legal formality for us — it's the precondition that lets the real work happen.
NDA firstA mutual non-disclosure agreement is signed before we receive any documents — not after the kickoff call, before the first file.
Need-to-knowClient information is shared inside ValidLeaf strictly on a need-to-know basis. No hallway stories, no ‘interesting client’ anecdotes.
Your name, your callWe never use client names, logos, or facility details in marketing, articles, or proposals to others without your explicit written permission.
WHERE LEAKS HAPPEN
The four ways client information escapes.
Most leaks aren't hacks. They're habits.
Uncontrolled Documents
Reports emailed to personal accounts, saved to shared drives, kept forever ‘just in case.’ We control distribution and retention from day one.
Marketing Creep
The case study that starts anonymized and gets more specific with each retelling. Nothing identifiable is published without written permission — no exceptions, no matter how flattering.
Lingering Access
The engagement ends, but system access and document copies don't. We define return-or-destroy at the start and execute it at the end.
OUR CONTROLS
How we protect what you share.
Specific practices, not vague promises.
Agreements Up Front
Mutual NDAs executed before document exchange. Confidentiality terms are also written into every statement of work.
Controlled Handling
Client documents live in access-controlled storage, shared only with the engagement team. No personal devices for client data, no public file-sharing links.
Minimal Retention
We keep working papers only as long as the engagement requires, plus any agreed retention period — then they're securely destroyed or returned, your choice.
Clean Handover
At engagement close: access revoked, copies returned or destroyed with confirmation, and a written record of what was done. Nothing lingers.
WHERE IT APPLIES
One method, five industries.
Cannabis is our home base — the method was built there first. The same evidence discipline serves each industry below, mapped to its own regulations.
Food & Beverage
Preventive controls, supplier verification, environmental monitoring, and traceability under 21 CFR Part 117 and FSMA.
Dietary Supplements
Component qualification, master manufacturing records, and laboratory controls under 21 CFR Part 111.
Cosmetics
Safety substantiation, GMP records, and adverse-event readiness under MoCRA.
Pet Food
Preventive controls for animal food, supplier programs, and sanitation under 21 CFR Part 507.
QUESTIONS
Confidentiality, answered.
Will you sign our NDA, or do we sign yours?
Either. We have a standard mutual NDA ready, and we're equally comfortable executing yours. The only non-negotiable is that one is signed before documents move.
Who inside ValidLeaf sees our information?
Only the people staffed on your engagement, on a need-to-know basis. We can name the team in the statement of work if you want it in writing.
Do you use our data to train AI tools or models?
No. Client information is never used to train models, improve tools, or develop content — anonymized or otherwise — without explicit written agreement.
What happens to our documents when the engagement ends?
You choose: secure return or certified destruction, executed within an agreed timeframe, with written confirmation. We don't keep client archives by default.
Can we restrict which facilities or systems you discuss?
Yes. Engagement-specific confidentiality terms — including facility-level restrictions — can be added to the statement of work.
Don't let the first gap be found under pressure.
Questions about how we'd handle your information? Ask us directly — a conversation, no documents required.