Everything outside counsel usually asks for, in one place, answered straight — including the questions where the honest answer is "not yet."
Nothing that identifies them. California's deletion system transmits one-way scrambled codes rather than names, and we work the same way end to end: your customer file is scrambled inside your own browser and the original never leaves your computer.
The practical consequence: if we were breached tomorrow, no consumer's identity would be exposed, because we do not hold one. How the matching works →
We would rather you see the gaps here than discover them in a questionnaire. If your review requires any of the outstanding items on a specific date, tell us and we will give you a straight answer about whether we can meet it.
That is the complete list. We will give notice before adding any sub-processor that touches customer data.
Where we process information on your behalf we act as a service provider under the CCPA and a processor under comparable laws: only on your instructions, only to deliver the service, never for our own purposes, and never sold or shared.
A data processing agreement containing the CCPA's required service-provider terms is available on request and will be provided before any paid engagement. This matters more than usual here — your own compliance depends on our status being correct, so it is part of what you are buying rather than boilerplate.
We are not a law firm and we do not give legal advice. Two decisions in the cycle are legal judgments — whether you qualify as a data broker, and whether a given record is exempt from deletion — and both stay with you. We give you the reference material, a place to record the decision and who made it, and a prompt to involve counsel.
We also do not delete data from your systems. We identify precisely which records must go; you remove them. Under the Delete Act the responsibility remains yours regardless of which vendor you use, so no honest vendor can take it off you.
You export everything — the full audit trail, cycle history, and permanent block list — in a machine- readable format, at any time, without asking us. We delete our copy within 30 days of termination unless you ask otherwise or the law requires retention.
Take the export regardless of whether you leave: independent audits begin in January 2028, with the first certifications due April 2029, and they can reach back over work done years earlier.
Ask and we'll answer plainly, including when the answer is no.