Data Handling for Engagements

Scope of this page

This page covers data handling for active consulting engagements. That means the 2-week AI Readiness Assessment, workflow redesign builds, and the fractional AI enablement advisory. For the website itself (forms, lead-magnet requests, marketing emails), see the Privacy Policy.

Where client data lives during an engagement

• Read-only by default. During the assessment phase, we work from copies of documents you choose to share, not from credentials into your systems. We take no production access unless the engagement scope requires it, and then only when that access is recorded in writing.
• Canadian-resident infrastructure. Working documents are stored on Google Workspace. We use the Canadian-resident configuration where Google offers it. Some engagements need different residency: on-premise, Nation-owned, or government cloud. For those, we store documents on infrastructure agreed in writing.
• No third-party CRM or marketing platform. Client data is not fed into any CRM, marketing-automation tool, or analytics platform during an engagement.

Retention

• Working materials are deleted within 90 days of the engagement ending, by default. That covers interview notes, working drafts, and internal docs. Earlier deletion is available on request.
• Final deliverables (the readout report, roadmap, tool shortlist, policy starter) are yours. We keep them as long as you ask us to. We hold a reference copy for up to 12 months after the engagement so we can support you, then delete it unless you ask us to keep it longer.
• Financial records (invoices, payment records) are kept for the period Canadian tax law requires. The Canada Revenue Agency requires business records to be kept for six years from the end of the last tax year they relate to. We keep them for seven years as a buffer.
• Deletion on request. You can ask us to delete materials at any time, during or after the engagement. Email connect@travisconsult.com with the subject Engagement data deletion. We’ll confirm within 5 business days.

Sub-processors

For the assessment phase, the only standing sub-processors are:

• Google Workspace (Canadian-resident option), for email, calendar, and working documents,
• Vercel, for any web-hosted artifacts shared with you (for example, a readout dashboard).

Implementation engagements may add AI-tool sub-processors, such as large-language-model providers. Any chosen during the assessment are disclosed in writing before implementation starts. Their data-handling terms come attached. You can require different tooling at any point. Some sectors require more, such as Indigenous-led organizations and sensitive public-sector work. There, we scope implementations to on-premise or Canadian-resident tooling only.

Indigenous data principles (OCAP®)

For engagements involving Indigenous organizations, Nations, or partners:

• Ownership. Data shared with us stays owned by you. We work from copies, never transfers.
• Control. You direct what we look at, what we don’t, and what gets kept at engagement end.
• Access. On request, we give you full access to anything we hold relating to your engagement, in a usable format.
• Possession. At engagement end, all materials pass to you, working drafts included, unless you direct otherwise.

If your governance body requires it, we select only tools on Canadian or Nation-owned infrastructure. We document each decision in writing. Your Council, Elders, or other appropriate body can review it before implementation.

OCAP® is a registered trademark of the First Nations Information Governance Centre (FNIGC). We use the term to show good-faith adherence to the OCAP® principles. It does not imply endorsement, accreditation, or partnership with the FNIGC.

Insurance and liability coverage

Travis Consulting arranges Commercial General Liability and Professional Errors and Omissions (E&O) coverage to fit each engagement. We confirm coverage details during scoping. A Certificate of Insurance comes with the standard procurement documentation before signing. To request it, email connect@travisconsult.com with the subject Insurance documentation. We’ll respond by the next business day.

Some engagements need more: additional named-insured coverage, higher limits, or project-specific endorsements. We negotiate those during scoping and document them in the signed engagement agreement.

Confidentiality

All engagement materials are treated as confidential by default. We’ll sign your standard NDA or a mutual NDA before discovery if your procurement process requires it. For most discovery conversations an NDA isn’t needed, because we stay at the organization level rather than the specifics.

Security incident response

If we discover a security event affecting your engagement data, we will:

1. Act immediately to limit further exposure,
2. Notify you within 72 hours of discovery with what we know,
3. Provide regular updates as the investigation proceeds,
4. Support any breach-notification obligations you have under PIPEDA, FOIPPA, or other applicable law.

Questions before procurement

If something on this page doesn’t fit your procurement requirements, raise it at scoping, not at signature. Email me or book a 15-minute call and we’ll work through it.