Security and compliance
Nothing moves until you have approved the buyer, the use and the terms.
Every step is designed around the seller's risk. Here is exactly what happens to your data, in order, and the limits written into every license. We work alongside your counsel and never promise legal outcomes.
What happens to your data, in order
Seven safeguards, each one written down.
01
NDA first
Before any detail beyond your form submission is discussed, we sign a mutual non-disclosure agreement. Your counsel can use our template or theirs.
02
Valuation from descriptions and small samples, never full datasets
The written valuation is produced from your description and a small, representative sample shared through an encrypted channel. Full datasets stay in your systems until a license is signed.
03
Rights and consent audit
We review customer, employee and vendor agreements, privacy notices, consent records and regulatory requirements with you and your counsel, and document what can be licensed, what needs a carve-out and what needs consent.
04
De-identification and PII removal before any buyer sees anything
Names, contact details, account numbers, card numbers, addresses and other identifiers are removed or transformed using methods appropriate to the data, such as HIPAA Safe Harbor or Expert Determination for health records. You review the output first.
05
Contract terms that restrict buyer use
Licenses limit use to model training and evaluation, prohibit resale and redistribution, prohibit re-identification attempts and prohibit use for profiling or targeting individuals. You approve every buyer and every permitted use.
06
Encrypted transfer and access logging
Delivery uses encrypted channels with named recipients. Access is logged and the log is available to you. Buyers receive only the de-identified dataset described in the license.
07
Deletion and audit rights
Licenses preserve your right to require deletion at the end of the term and to audit compliance with the use restrictions. Samples shared during valuation are deleted if no deal proceeds.
Knowledge Fuel is not a law firm and does not provide legal advice. We work alongside your counsel, document every decision in the contract and decline deals whose compliance requirements cannot be met.
Regulatory map
Regulations we work within
The specific requirements depend on your data and your industry. We map them with your counsel before valuation is finalized.
- HIPAA
- De-identification by Safe Harbor or Expert Determination; business associate agreements where required.
- GDPR and UK GDPR
- Lawful basis, purpose limitation and data subject rights for any EU or UK personal data; anonymization standards.
- CCPA and CPRA
- De-identification conditions, notice requirements and the distinction between de-identified data and personal information.
- GLBA
- Non-public personal information held by financial institutions and their service providers.
- PCI DSS
- Redaction of card data in recordings, tickets and transaction records.
- Call recording consent
- One-party and all-party consent states, and notice requirements for recorded calls.
- FERPA and COPPA
- Student records and data from children under 13.
- Trade secrets and export controls
- Protection of proprietary processes, and EAR or ITAR screening for technical data.
FAQ
Security questions
Who at Knowledge Fuel sees our data?
Only the people working on your valuation, under the NDA and our internal access controls. Samples are stored encrypted and deleted if no deal proceeds.
Can buyers re-identify people from de-identified data?
Licenses prohibit any attempt, and the de-identification method is chosen to make it impractical. Where the data is sensitive, we apply stricter methods and, where appropriate, expert determination.
Do you hold certifications such as SOC 2?
Our security practices are documented and available under NDA. Formal certifications are published here as they are completed.
What happens at the end of a license term?
The buyer's obligations under the license continue, including deletion where the contract requires it, and you retain the audit rights written into the agreement.
Start with a conversation under NDA.
Describe your data in ten minutes. If it is a fit, the NDA comes next and nothing moves before a signed license.