Start with a description, not the documents.
The first message should identify the decision, the kinds of records held, a rough page count and any urgent deadline. Do not attach the full archive merely to ask whether a review fits. Keep passwords, payment-card details, identity documents, privileged advice and unrelated personal information out of a general form.
A transfer channel, permission to share and the intended readers are separate questions. Payment or a form acknowledgement is not permission to expose every file. For a legal deadline or a privilege question, speak with qualified counsel rather than waiting for a research timetable.
Write down the handling arrangements.
Use this checklist before transfer. It is a set of questions to agree, not a statement that Cyberdile uses every listed measure or provider. The website’s privacy notice describes initial enquiries; commissioned-record terms are agreed for the matter.
| Item | Written answer to obtain |
|---|---|
| Storage and processing | Where will primary records, working copies and backups be stored or processed? Name relevant countries and providers, and any transfer limits. |
| Transfer | Which exact channel is approved, who receives it and how receipt/completeness will be confirmed? Keep credentials out of the record bundle. |
| Access | Which roles need access, what can each do, and who approves an added reviewer or subcontractor? Specify the access actually needed, not blanket access. |
| AI and other tools | Which record classes, if any, may be sent to which tool/provider? Record account controls, retention/training settings and the permitted task; do not assume a product name guarantees them. |
| Retention and backups | When are originals, derivatives and outputs reviewed or removed? How do retained backups, legal holds and restore copies affect deletion? |
| Corrections and incidents | Who receives a correction or incident report? How are access, preservation, containment and affected outputs reviewed? Agree contacts and a practicable process. |
| Onward sharing | Who may receive the brief or sources, for what purpose and with which restrictions? Publicity needs a separate decision. |
Permission to review is not permission to reuse.
Agree tool use before material enters a different processing environment. A permission to organize records does not by itself authorize model training, publication, a vendor demonstration or an unrelated future investigation. An AI-assisted draft still needs a source check and accountable human review.
Ask for the actual settings and contract applicable to the proposed tool and account, including providers and subprocessors where relevant. If an answer is unknown, write “not yet agreed” and withhold the affected records. Do not turn a generic security or “private AI” label into a data-handling guarantee.
Make retention and deletion understandable.
Identify which original must remain with the owner, which working copies the reviewer needs and which output the engagement creates. Agree a retention purpose and review point for each. Initial-enquiry retention is not automatically the retention period for commissioned records.
Ask what deletion means for live storage, derivative extracts, sent messages, shared copies and backup rotations. A removed folder does not necessarily erase a backup. Record limits rather than promising immediate deletion from every system. A legal hold or required recordkeeping needs the appropriate advice and agreed treatment.
A private review is not publication permission.
A private commissioned brief and a newsroom or public-interest project have different recipients and consequences. Do not assume that an investigation question authorizes contacting a named person, sending records to a journalist, naming a party publicly or circulating material to other potential claimants.
Any proposed publication or external approach needs a separate decision about purpose, authority to share, lawful handling, fairness and who approves the release. Keep the private working record distinct from a publishable account. Commissioning research does not itself create legal privilege or an absolute confidentiality guarantee.
Close the transfer loop and keep corrections connected.
Confirm the received source IDs, page counts, versions and any unreadable or missing part before accepting the review boundary. Track derivatives back to their originals. If a source changes, identify the dependent chronology, table and finding rather than silently replacing a number.
Keep an agreed contact for access corrections, accidental disclosure, unexpected recipients or a handling concern. An incident plan should say who decides what to preserve and contain; urgent security or legal consequences need the appropriate specialist. Do not investigate an incident by broadly forwarding sensitive material.
A usable handover says what was reviewed, what remains unresolved, who can act next and what copies remain. The source-passport guide and local matter brief help prepare that boundary before a transfer.