In a corporate market the recovery is rarely the slow part. The slow part is getting a new vendor approved while a drive sits in a drawer. A security questionnaire, a certificate of insurance, an NDA, a data handling policy, sometimes a W-9 — each arriving days apart because nobody asked for them all at once.

So say on the first call that a vendor review is coming and we’ll send the whole packet up front: certifications, insurance details, our data handling and retention policy, an NDA ready to sign, and a Business Associate Agreement where health data is involved. Recovered data is securely erased two weeks after completion unless you arrange otherwise in writing, and the chain of custody is documented from intake to return.

One more thing that matters to a compliance reviewer more than it does to anyone else: there is no partner facility in our process. Whatever you hand us is worked on by us, in one building, by one named engineer. That is a much shorter answer to “where did our data go” than the alternative, and it’s the answer you’ll be asked for if anything ever goes wrong.