Since 2018
Privacy-safe enterprise data
VOSB & SDVOSB
U.S. Veteran-Owned, Service-Disabled
SCC Transfers
EU/UK/CH per privacy policy
GDPR · CCPA · CPRA
Consent-first data sourcing
Start with these
Use these routes as canonical references in procurement threads and vendor reviews.
What diligence teams check
- Provenance artifacts: sources, processing, refresh cadence, and audit trail.
- Sensitive categories: explicit exclusions, especially for precise location in sensitive contexts.
- Rights handling: opt-out, delete, and consent revocation SLAs.
- Usage boundaries: what’s permitted for targeting vs measurement vs risk.
Privacy routes
FTC / enforcement resources
Risk + fraud
Need a diligence brief?
Tell us the use case, geography, and intended activation. We’ll provide a compliance-aligned scope and a matched sample where appropriate.
A practical procurement checklist (copy/paste for diligence)
If you need a simple structure for vendor review, use this. It’s written in the language procurement and legal teams actually use: provenance, permitted use, exclusions, and rights handling.
Provenance
- Source categories and consent mechanism (what “opt-in” means in practice).
- Processing steps and refresh cadence; schema change control.
- Audit artifacts you can retain internally (manifests, sampling notes).
Permitted use
- Targeting vs measurement vs risk use boundaries.
- Downstream sharing constraints (agencies, partners, sub-processors).
- Retention policy and derived-feature rules.
Rights + exclusions
- Opt-out/delete SLAs and propagation expectations.
- Sensitive-category exclusions (especially precise location contexts).
- Incident response: how breaches/complaints are handled and notified.
Related buying guides
Diligence tends to follow the data layer you’re evaluating. These hubs route to the right canonical pages and supporting resources.
Vendor comparisons
Compliance questions often show up as “compare vendor X vs vendor Y.” Use these pages to keep the conversation anchored to artifacts: provenance, exclusions, rights handling, and delivery constraints.
Frequently asked questions about data procurement privacy and compliance
What provenance artifacts should legal request before licensing?
Ask for source-category summaries, field dictionaries, allowable joins, refresh and retention schedules, and subprocessors list. GSDSI provides sourcing briefs and trust artifacts on request; tie them to the signed order or DPA.
How are sensitive categories handled?
Commercial mobility and location feeds exclude sensitive places (for example healthcare, worship, schools) and document category exclusions in delivery manifests. Align activation use cases with FCRA-ineligible labeling where consumer-report-adjacent data is out of scope.
What deletion and opt-out SLAs should contracts include?
Define propagation timelines from consumer rights requests through production feeds and downstream activations. Reference /privacy-center workflows and security-program incident language during negotiation.
Is there a DPA template for procurement?
A drafting scaffold is at /trust/dpa (non-binding until countersigned). Subprocessors are listed at /trust/sub-processors. Executable obligations emerge only in the signed agreement.
How should buyers respond to post-FTC data-broker orders?
Review consent chains, sensitive-location exclusions, and broker-specific representations in the data brokers post-FTC diligence resource. Map each feed in the order to documented permitted uses before scale.
What is the difference between the Trust Center and Privacy Center?
Trust Center (/trust) covers security program, subprocessors, and DPAs for enterprise procurement. Privacy Center (/privacy-center) covers consumer-facing rights (access, delete, do-not-sell). Legal teams typically review both plus /sourcing-methodology.