Security questions to ask any digitization provider

Handing an archive to a scanning provider means letting strangers carry your records out of the building, open every file, and read every page. Personnel files, board papers, contracts, patient records, identity documents. There is no version of this where the risk is small, and there is no proposal that will describe it as anything other than fully secure.

So the questions below are written to be sent out unedited. They are the ones we would want asked of us, and a provider that answers them with documents rather than adjectives is telling you something a brochure cannot.

Chain of custody

• Show me the written chain-of-custody procedure. At what point does custody formally transfer, and what is signed at that moment?
• What is the tracking unit: box, file, or batch? Is it barcoded, and at which stages is it scanned?
• Where do my records physically sit between stages, and how are they segregated from other clients' material?
• What is the reconciliation report at the end, and what does it prove? Show me one from a comparable project with the client details removed.
• If a container cannot be reconciled, what is the procedure, and who is notified within what timeframe?

Transport

• Who collects, in what vehicle, and are they your employees or a courier?
• Are the vehicles dedicated to document transport, and are loads sealed and tracked?
• What insurance covers documents in transit, and what is the limit? Send me the certificate rather than the reference.
• What happens if a collection is interrupted, or if records must be left overnight in the vehicle or at a depot?

Facility and physical access

• Where is the production floor, and can I visit it before signing? Reluctance is itself an answer.
• Is the scanning area access-controlled and separated from general office space? Who else can enter it?
• What is the policy on phones, cameras and personal storage devices on the production floor, and how is it enforced rather than merely stated?
• Are there CCTV coverage and access logs, how long is each retained, and can I see the coverage plan for the area my records would occupy?
• How are physical records secured out of hours, and is there a separate secure area for higher-sensitivity material?

Personnel

• What vetting is carried out before someone works on client documents, and does it differ for permanent staff, temporary staff and agency workers?
• Are confidentiality undertakings signed by the individuals who handle records, or only by the company?
• Are those undertakings binding after employment ends, and how is that enforced in practice?
• How is access revoked when someone leaves, physically and in every system, and how quickly?
• What security training do operators receive, how often, and what does it actually cover?

Subcontracting and location of work

This is the question most often answered incompletely, and the one where an incomplete answer causes the most damage later. Ask it directly and ask for it in writing.

• Is any part of this work performed by another company, at another site, or in another country? Include indexing, verification, keying, exception handling and hosting.
• If yes, name them, name the country, and state which activities they perform and what data they see.
• Do subcontractors carry the same vetting, confidentiality and security obligations, and how is that verified rather than assumed?
• Can subcontracting arrangements change during the contract without my consent? The answer should be no, with a written notification obligation.

Systems, transfer and data residency

• How are images and index data transferred to me, and what encryption protects them in transit? Email attachments and consumer file-sharing links are not answers.
• Is data encrypted at rest on production systems and on any working copies, and who holds the keys?
• In which country do my images and index data reside during processing, and where are backups held? Ask about backups specifically, because they are the answer most often overlooked.
• If a cloud service is involved, which one, in which region, and under whose account?
• How is access to my data controlled internally? Can any operator see any client's material, or is access scoped to assigned batches?
• Are removable media permitted on production machines, and what technical control enforces that policy?
• What logging exists of who accessed which documents, and for how long is it kept?

Retention and destruction of the provider's copies

• How long do you keep my images and index data after delivery and acceptance, and why?
• What is the deletion process at the end of that period, and does it cover backups, replicas and previous versions?
• Will you issue written confirmation of deletion, itemised to what was deleted and when?
• For physical originals: return, storage or destruction? If destruction, is it witnessed, by what method, and what does the certificate list?

Audit rights and incident response

• Do I have the right to audit, or to appoint an auditor? On what notice, how often, and at whose cost?
• Will you complete my security questionnaire, and will you accept the resulting commitments as contract terms rather than as a completed form filed away?
• What is your incident response process, and within what timeframe will you notify me of a suspected breach involving my records? A specific number belongs in the contract.
• Who is the named contact during an incident, and what happens outside business hours?
• Has an incident affecting client records occurred, and what changed as a result? A provider that has never had an incident of any kind is either very small, very new, or not counting carefully.

Using this list without wasting everyone's time

Send the whole list at shortlist stage and read the shape of the response rather than scoring it line by line. Providers who answer in specifics, decline the questions that do not apply to them, and say plainly where a control does not exist are the ones worth continuing with. Uniform confidence across every question usually means the form was completed by someone in sales who did not consult operations.

Then do two things the questionnaire cannot do. Visit the floor, because five minutes in the room tells you more about access control and phone policy than any written answer. And put the answers into the contract, because a security questionnaire that is filed rather than incorporated has no force at all when it matters.

One closing limitation, stated plainly: no provider can eliminate this risk, and any provider that says otherwise has told you something useful about how they handle uncomfortable questions. What a good provider can do is make the controls inspectable, the obligations contractual, and the failure modes something you were told about in advance rather than something you discover.