Data ownership

Ownership principle

Every record you enter into the platform — assessment data, system boundaries, control evidence, policies, and associated documents — belongs to your organization. Winston & Miller does not claim ownership of client data, does not use it for any purpose other than delivering the contracted services, and does not share it with any other party.

Data is never used to train, fine-tune, or evaluate any model. No analytics, benchmarking, or cross-client comparison is performed on identifiable client data.

Data export

Any authorized user can request a full export of all data associated with their organization at any time. Exports are available in JSON and CSV formats and include all records, metadata, and audit history within the retention window.

Exports are accompanied by a SHA-256 hash manifest that allows you to verify the completeness and integrity of the export package. See Audit logging for verification instructions.

Exports are delivered within one business day of request for standard sizes. Clients with very large data sets may contact jessica@winstonandmiller.com to coordinate delivery.

No cross-tenant data sharing

Each client's data partition is logically isolated from every other client's data. Row-level security policies enforced at the database layer make it architecturally impossible for one client's queries to access another client's records — even in the event of an application-layer misconfiguration.

No data is shared between clients for benchmarking, comparison, or any other purpose. Aggregate, de-identified metrics used for platform health monitoring do not contain information that could be attributed to any individual client.

Retention and destruction

Data is retained for the duration of the active engagement plus a 90-day post-engagement window. During the post-engagement window, the client may request a final export. After the window closes, all client data is permanently deleted using NIST SP 800-88 Rev 1 media sanitization procedures.

A signed deletion certificate documenting the sanitization date and method is provided to the client on request.

Audit log records that reference client data are subject to the same retention schedule. Once client data has been destroyed, audit records that would permit reconstruction of that data are also purged.

Legal hold

If Winston & Miller receives a lawful order requiring preservation of client data beyond the standard retention window, we will promptly notify the client to the extent permitted by law.

Clients may also instruct us to place a legal hold on their own data. A legal hold suspends scheduled deletion for the specified records and is removed only by written authorization from the client. The hold does not extend to other clients' data.