Responsible Disclosure

Compliance Bureau treats exposure findings as confidential operational matters. This page describes our handling practices. It is not a certification, regulatory filing, or legal commitment beyond good-faith professional conduct.

How findings are communicated

• Findings are directed to an appropriate organizational contact when one can be reasonably identified.
• Communications describe observed conditions, evidence classification, and open proof gaps.
• We do not publish identifying client findings as marketing content.

Evidence minimization

• We retain only what is needed to support the finding and verification.
• Unnecessary copies of personal, financial, medical, or authentication data are avoided.
• Example materials on this website are fully sanitized and fictionalized. The public site does not display real client records, verification samples drawn from real individuals, credentials, or payment-card data.

Protection of personal information

• Personal information encountered during assessment is handled as confidential.
• We do not distribute unnecessary sensitive information to third parties.
• Where excerpts are shared with the organization, we prefer class labels and redaction over full records when sufficient for remediation.

Limited handling of sensitive evidence

• Access to raw evidence is limited to personnel working the engagement.
• Transfer of evidence uses channels agreed with the organization when remediation or counsel review requires it.
• We do not claim possession of data sets we do not hold.

Verification requests

• Organizations may request clarification of evidence classification (confirmed, assessed, unresolved, not demonstrated).
• Follow-up verification of remediation is available as an optional, scope-based engagement.

Disputes and clarification

• Organizations may dispute factual accuracy or provide internal context that changes classification.
• We update documentation when new authorized evidence materially changes a finding.
• Disagreement about legal conclusions should be directed to the organization’s counsel; we do not act as legal authority.

Remediation status

• Organizations may tell us when remediation is complete or in progress.
• We may record status for verification purposes when engaged to do so.
• Remediation with Compliance Bureau is optional; status updates are not conditioned on retaining us.

Contact for disclosure matters

Email desk@compliance-bureau.org with the subject line beginning Responsible Disclosure. Do not send passwords, full card numbers, or large volumes of personal files in the initial message.

We distinguish what is observed, what is demonstrated, and what remains unknown — including in disclosure correspondence.