Trust and data handling

A target list can reveal an acquisition strategy even when every company on it is public. We treat the list, the criteria, and the research assembled around them as client information. Public sources do not make a client’s mandate public.

Your docket and your data

Database separation

Each client’s docket is a separate database.

Ownership

The client owns its data. Target lists and criteria are confidential.

Export

Export to CSV or Excel at any time.

Reuse

Client dockets are not pooled or resold.

Termination

Deletion is available on request at termination; discuss the applicable retention and deletion process when scoping the engagement.

Database separation is one part of handling information responsibly. Before the mandate begins, identify who needs access, what the team intends to import, and what needs to leave in an export. If your firm has requirements for retention, access review, or offboarding, bring them into the written scope rather than assuming a general product description settles them.

You can keep the opening conversation limited to mandate boundaries and public examples. Please do not send material non-public information or confidential deal documents in unsolicited email. Use the contact page to describe the handling requirements before sharing sensitive material.

Public research, with traceability

The research described here uses public information. We do not bypass logins, paywalls, or technical restrictions to collect it. Robots directives and source terms are respected. A source being useful to an acquisition thesis does not create permission to obtain it through a restricted route.

Retained source pages support traceability: an accepted field points to a verbatim quotation and the page behind it. Dates help a reviewer assess freshness. Retention does not make a statement permanently true, and a quotation establishes what the source says rather than guaranteeing the source’s accuracy.

Audit reviews the retained material with fetching denied. Unsupported findings are struck and unresolved gaps remain visible. This makes it possible to challenge a conclusion without relying on a new search that may return different material. The evidence standards guide discusses the limits as well as the method.

AI use and provider questions

Triage, Scout, and Audit are research agents with separate roles. Their work combines company identity checks, structured collection, and review of collected evidence. Model output is not itself a supporting source. The record must show the material that supports an accepted answer.

Processing relies on three categories of provider. The categories below are what we can state generally; for the named providers and their terms in force, ask us before submitting client material.

Cloud hosting

Infrastructure that hosts the platform and stores each client’s docket and retained source pages.

LLM API providers

Language-model services the research agents call. Providers are used under terms that do not permit training on the material we send.

Email delivery

Services that deliver email on the client’s behalf when optional outreach is enabled, and platform notifications.

These are categories, not a certification or an audit statement, and we make no SOC 2, ISO 27001 or similar claim. Ask us for the current named list and its data terms and review them against your requirements before submitting client material. If a questionnaire asks about processing location, provider access, or model data policies, send the questions directly so the answer reflects the current setup and the proposed scope.

Retention and deletion

Unless agreed otherwise, a client’s docket and retained evidence stay available for the length of the engagement so the record remains inspectable. On request at termination, we delete the client’s docket and retained material; export what you need first. If your firm requires a fixed retention period or a deletion confirmation, agree it in the written scope.

Optional outreach, with approval

Research access does not authorize contacting a target. The client approves messaging and each target before outreach. Exclusion lists are honoured, including companies your team identifies as existing relationships or otherwise out of scope. Share those exclusions before contact is prepared.

Channel and jurisdiction matter. The outreach review considers CAN-SPAM, CASL, GDPR, and UK PECR where relevant; it does not assume one rule applies to every recipient. The client and Docket need to agree the intended geography, permitted channels, and handling of opt-outs before a campaign runs. The outreach compliance guide provides the fuller discussion.

Sender authentication uses SPF, DKIM, and DMARC. Authentication supports the identity of the sending domain; it does not establish permission to contact a recipient or guarantee delivery. Messaging approval, target approval, exclusions, and applicable requirements remain separate parts of the process.

Report a security concern

Email [email protected] with the subject “Security”. Describe the affected service, the observed behavior, and enough information to understand the concern. Keep the first report free of credentials, unnecessary personal data, and confidential target records.

If evidence would expose sensitive information, describe its nature first and ask how to provide it appropriately. Avoid actions that disrupt the service or access another client’s information. This channel also handles questions from firms reviewing the platform before an engagement.

For a product view using illustrative data, open the live demo. To discuss your firm’s requirements before research begins, start an enquiry.