1 minute readReference note
What sensitive information should stay out of shared ORM evidence files?
In brief
Shared ORM evidence should contain only the information needed to investigate an issue and support the work. Public reputation research does not make every underlying document suitable for broad sharing.
Review correction files for contracts, identity documents, employee details, and confidential transaction records. Use public sources for facts they demonstrate, and send sensitive supporting material through a restricted, authorized route.
Match collection, access, retention and sharing to the evidence task. Review screenshots for personal data unrelated to the issue. Check exports and shared folders as well as the final explanation, then remove unnecessary sensitive material before sharing.
Public content can state the necessary fact without disclosing the entire evidence file. Controlled versions also support accuracy by reducing the chance that obsolete or incomplete documents are used to justify a current claim.