Purpose-limited use
Confidential information is intended to be used only for authorised business purposes and the services agreed with the customer.
Rudrriv Trust Center
Confidentiality and responsible information handling
Rudrriv protects confidential information through purpose-limited use, need-to-know access, contractual duties, secure collaboration and controlled retention. Safeguards are matched to the service, systems, sensitivity and agreed requirements.
- Need-to-know access
- Purpose-limited use
- Controlled sharing
- Responsible retention
Confidentiality control modelAuthorise, protect, limit and review
Need to know
PeopleAuthorised roles
ProcessDefined handling
TechnologyAccess safeguards
Direct answer
How Rudrriv approaches confidentiality
Rudrriv treats confidentiality as a business, contractual and security responsibility. Customer information should be accessed only by authorised people, used only for approved work, shared only through controlled channels and retained only for a defined reason.
Controls vary because a public website project, financial operations engagement, software-development programme and sensitive data-analysis assignment do not create the same risk. The customer agreement, statement of work, data processing terms and documented instructions determine the final requirements.
Core principles
The principles behind our confidentiality approach
Confidentiality is supported by clear purpose, restricted access, proportionate safeguards and accountable handling throughout the engagement.
Need-to-know access
Access is intended to be limited to authorised people who require the information for assigned work.
Proportionate safeguards
Handling controls are selected according to sensitivity, system capability, contractual commitments and assessed risk.
Separation and control
Customer materials are handled within approved workspaces, accounts and workflows designed to reduce unnecessary exposure.
Defined retention
Retention, return and deletion expectations are addressed through the applicable agreement, project requirements and legal obligations.
Escalation and accountability
Suspected loss, misdirection, unauthorised access or disclosure should be reported promptly for assessment and response.
Information covered
Confidential information can take many forms
Protection is based on the nature and context of the information, not only whether a document carries a confidentiality label.
Business and commercial information
Plans, pricing, proposals, contracts, forecasts, customer lists, supplier details, operating models and internal communications.
Technology and product information
Source code, architecture, credentials, configurations, roadmaps, designs, test data, technical documentation and security findings.
Data and operational records
Datasets, reports, analytics, financial records, process documentation, support records and information stored in customer systems.
Personal and workforce information
Customer, employee, applicant, contractor or end-user information handled within the agreed service and applicable privacy terms.
Creative and intellectual property
Unreleased campaigns, manuscripts, designs, brand assets, research, concepts, media, presentations and other protected materials.
Information marked or understood as confidential
Information labelled confidential and information that a reasonable person would understand should not be disclosed publicly.
Clear boundaries
What confidentiality protection includes—and what it does not change
Direct boundaries help customers understand how confidential information is handled and where separate contractual decisions remain necessary.
Confidentiality protection includes
- Restricting use to authorised services and business purposes.
- Limiting access to people and providers with a legitimate need.
- Applying appropriate access, sharing, transfer and retention safeguards.
- Escalating suspected unauthorised access, loss or disclosure.
- Respecting stricter project requirements documented in the applicable agreement.
Confidentiality does not automatically
- Make every piece of information a trade secret or legally privileged.
- Prevent disclosure that is required by law, court order or authorised regulatory process.
- Replace the need to define ownership, data protection, retention or security terms.
- Remove the customer’s responsibility to control its own users, systems and sharing decisions.
- Guarantee that no human error, malicious act or technology failure can ever occur.
Control areas
Send a questionnaire
How confidentiality is supported in delivery
The applicable control set is based on the service, information sensitivity, customer environment, contractual commitments and technical capability.
Contractual confidentiality
- Confidentiality terms in applicable agreements
- Defined permitted uses and disclosure boundaries
- Project-specific restrictions where agreed
- Survival periods and trade-secret protection as applicable
Authorised workforce access
- Access based on role and assigned responsibility
- Confidentiality duties for relevant personnel
- Awareness of handling and escalation expectations
- Access revision or removal when no longer required
Identity and access safeguards
- Named accounts where supported
- Least-privilege permissions
- Multi-factor authentication where available and appropriate
- Controlled privileged or administrative access
Secure storage and collaboration
- Approved storage and collaboration locations
- Restricted sharing and recipient verification
- Version and approval controls where relevant
- Avoidance of public links for sensitive material
Controlled transfer
- Approved transfer methods based on risk
- Encryption in transit where supported
- Secure credential-sharing practices
- Checks before external or cross-team disclosure
Data minimisation
- Request only information needed for the service
- Limit copies, exports and local downloads
- Use reduced or masked data where practical
- Avoid unnecessary use of sensitive production data
Third-party and subcontractor controls
- Need-based engagement of approved providers
- Relevant confidentiality and data-protection terms
- Access and information-sharing limits
- Customer approval where contractually required
AI-assisted tool controls
- No routine submission of confidential client material to public AI tools
- Tool use based on authorisation, terms and risk
- Data minimisation and human review
- Customer-specific restrictions take priority
Retention, return and deletion
- Retention based on service and legal needs
- Return or deletion according to agreed terms
- Removal of access during transition or closure
- Documented exceptions where retention is legally required
Incident and misdelivery response
- Prompt reporting of suspected exposure
- Assessment, containment and evidence preservation
- Customer communication based on verified facts and obligations
- Corrective actions and lessons learned where appropriate
Legally required disclosure
- Disclosure limited to what is legally required
- Notice to the customer where lawful and appropriate
- Reasonable support for protective treatment
- Review by authorised legal or management personnel
Review and assurance support
- Reasonable due-diligence responses
- Evidence sharing subject to confidentiality and security
- Project control reviews where agreed
- Remediation tracking for identified issues
Information lifecycle
Step 01
Step 02
Step 03
Step 04
Step 05
Step 06
Confidentiality across the engagement lifecycle
Protection begins before information is received and continues through access closure, return, deletion or transition.
Identify and classify
Confirm what information is needed, why it is required, its sensitivity and any customer handling instructions.
Approve access
Grant access to authorised personnel through approved accounts, systems and workspaces based on assigned responsibilities.
Use and collaborate
Use information only for agreed work, apply appropriate sharing controls and maintain clear review or approval routes.
Transfer and disclose
Verify recipients, use approved channels and disclose only the minimum information needed for the authorised purpose.
Retain and review
Keep information only while required by the engagement, legitimate operational needs, applicable terms or law.
Return, delete or transition
Close access and handle return, deletion, export or transition according to the contract and documented instructions.
Practical handling
What customers can expect during delivery
The operating model should make confidentiality requirements visible in everyday work, not leave them only in contract language.
Scope before access
Rudrriv and the customer identify required systems, information, roles, purposes and restrictions before material access is granted.
Approved collaboration spaces
Teams use agreed repositories, project tools and communication channels rather than uncontrolled personal storage or public sharing.
Named ownership
Project owners, reviewers and escalation contacts are defined so access and disclosure decisions have accountable owners.
Prompt escalation
Suspected misdelivery, oversharing, unauthorised access or credential exposure should be escalated without waiting for complete certainty.
Global references
Information security reference
Cyber-risk reference
Assurance reference
Legal and customer context
Recognised standards and assurance concepts
Rudrriv’s confidentiality approach is informed by recognised information-security, cyber-risk, assurance, privacy and contractual principles.
ISO/IEC 27001:2022
Provides a risk-based management-system reference for protecting the confidentiality, integrity and availability of information.
NIST Cybersecurity Framework 2.0
Supports structured governance and risk outcomes across Govern, Identify, Protect, Detect, Respond and Recover.
AICPA Trust Services Criteria
Recognises confidentiality as one of the trust service categories relevant to service-organisation controls and assurance.
Applicable privacy and contract requirements
Confidentiality controls are also informed by applicable privacy obligations, customer agreements and project-specific instructions.
No unverified certification claim: references to standards and assurance criteria describe control concepts used for guidance. They do not state that Rudrriv holds a certification, SOC report or other independent attestation unless current supporting evidence is separately published.
Connected trust topics
Review related Rudrriv trust information
Confidentiality works together with information security, privacy and contractual data-processing requirements.
Frequently asked questions
Confidentiality questions from customers
These answers provide a general overview. Contract-specific terms and documented project requirements control where they differ.
What does Rudrriv treat as confidential information?
Rudrriv treats information as confidential when it is identified as confidential or when its nature and the circumstances make it reasonable to understand that it should not be publicly disclosed. This may include business, technical, financial, customer, workforce, product, creative, operational and security information.
Will Rudrriv sign a non-disclosure agreement?
Rudrriv can review a mutual or customer-provided non-disclosure agreement during the commercial process. Final terms depend on the services, information involved, duration, permitted recipients, required disclosures, remedies, governing law and consistency with the main service agreement.
Who can access customer confidential information?
Access is intended to be limited to authorised Rudrriv personnel, contractors or approved service providers who need the information for assigned work and are subject to relevant confidentiality obligations. Exact access also depends on customer-controlled systems and permissions.
Does Rudrriv use customer confidential information to train public AI models?
Rudrriv does not intend to submit confidential customer information to publicly accessible AI services for unrelated model training. Any AI-assisted use involving customer information should be authorised, necessary for the agreed work and subject to appropriate contractual, access, minimisation and review controls.
How does Rudrriv handle confidential information in remote or distributed delivery?
Remote delivery is expected to use approved accounts, systems, collaboration spaces and secure-working practices. Access, device, transfer, workspace and communication controls should match the sensitivity of the information and the requirements agreed with the customer.
Can Rudrriv work inside our systems instead of receiving copies of our data?
Yes, where technically and operationally suitable. Working within customer-controlled systems can reduce copying, but responsibilities for account administration, permissions, monitoring, exports, retention and offboarding should be clearly assigned.
How are subcontractors or third-party tools handled?
Third parties should be used only where needed for the service and subject to appropriate access, confidentiality, data-protection and security terms. Customer notice or approval is addressed where required by the applicable contract or data processing terms.
What happens when confidential information is sent to the wrong recipient?
The issue should be reported promptly. Rudrriv will assess the information involved, recipient, access, potential impact and available containment actions, then communicate and remediate according to verified facts, contractual commitments and applicable law.
How long does Rudrriv keep confidential information?
Retention depends on the service, customer instructions, contract, operational need, dispute or audit requirements and applicable law. Return, deletion, export and transition expectations should be documented for the engagement.
Does this page mean Rudrriv is ISO 27001 or SOC 2 certified?
No. This page describes Rudrriv's confidentiality approach and recognised references. It does not represent certification, attestation or independent assurance unless Rudrriv separately publishes current supporting evidence.
How can a customer request a confidentiality review?
Send the relevant requirements, questionnaire or NDA request to support@rudrriv.com. The response may depend on the proposed scope, sensitivity, systems, jurisdictions, legal restrictions and whether additional confidentiality protections are required before evidence is shared.
Need to review confidentiality requirements before sharing information?
Send your NDA, handling requirements, procurement questionnaire or proposed project restrictions to Rudrriv before access is provided.