Records are the reason PRC exists, and we hold ourselves to the standard we teach. This notice states the protections that govern client records in PRC's care. It is part of every engagement, alongside the written scope.
The channel rule — read this first
PRC accepts sensitive records only through the secure channel agreed in your engagement — never through public website forms, the client portal, or ordinary unencrypted email. Our forms say so, and our staff will never ask you to send account numbers, government ID numbers, or medical details outside the agreed channel. If anyone claiming to be PRC does, stop and call us — that is how you know something is wrong.
Security commitments
Sensitive client records in PRC's care are protected by:
- A written information-security policy that every person with access signs.
- Role-based access — only the people working your engagement can reach your records.
- Multifactor authentication on systems that hold client records.
- Encryption in transit and at rest.
- Source-document preservation — your originals are never altered; work happens on copies.
- Audit logging and version history on records systems.
- Backups, with restore testing — a backup that has never been restored is a hope, not a backup.
Lifecycle commitments
- Retention and deletion schedules agreed in writing as part of your scope.
- Written incident-response procedures; if an incident affects your records, you will be told promptly and plainly.
- Security review of any vendor or tool that touches client records.
- Confidentiality obligations for everyone who works on your engagement.
- At offboarding: secure return or verified deletion of your records, at your direction, confirmed in writing.
What the client portal is — and is not
The client portal shows engagement status, milestones, and update notices, and delivers PRC's finished deliverables to you. Portal documents are stored encrypted, are accessible only to your signed-in engagement, and every download — and every denied attempt — is written to an access log we review. The portal is one-directional by design: PRC delivers documents to you through it, but records never travel to PRC through the portal or any public form — only through the engagement's agreed secure intake channel.
Your records are yours
PRC claims no ownership of client records — ever. You may direct return or deletion at any time, subject only to obligations in the written engagement, and we will confirm completion in writing.
Questions about records handling: contact@paularecordscustodian.com.