Data Protection Information

Security measures

Data is encrypted in transit (HTTPS). Uploaded documents are encrypted before storage in private object storage, scanned for malware before access, and only accessible through authenticated, authorised requests. Bank payment instructions are stored encrypted. Staff access is role-based with mandatory two-factor authentication, and access and changes are logged.

Access controls

Clients only see their own cases, documents, invoices and payments. Staff only access the records they are authorised to handle.

Proposed retention schedule

• All periods below are proposed and pending legal review.
• Client account: while active, plus 3 years after closure.
• Case records, messages and reports: 7 years after the case closes.
• Billing and payment records: 7 years.
• Uploaded documents: 3 years after the case closes, or earlier on request unless a legal hold applies.
• Case submissions without an engagement, and contact inquiries: 2 years.
• Complaint records, and audit and security logs: 3 years.
• Files rejected as malicious: deleted immediately; incident record kept for 1 year.
• Email delivery records: 1 year.
• Expired sign-in sessions and one-time codes are removed automatically. Other deletion is currently carried out on request and on review, not automatically.

Deletion requests

Email vantageinvestigation@gmail.com from the address on your account. We aim to respond within 30 days.

International transfers

Safeguards for international transfers are being reviewed with legal counsel and will be described here once confirmed.

Data protection contact

vantageinvestigation@gmail.com · +1 (701) 890-2740.