Handling sensitive intelligence

Define the investigation scope

Document the purpose of the investigation and the organizations, accounts, or assets your team is authorized to review. Keep the work connected to that purpose as new findings emerge.

Identify who owns the investigation and which teams need access to its results. Agree how sensitive findings will be escalated before copying them into wider workflows.

Use the minimum evidence needed

Exposure records may contain personal information, credentials, or other sensitive material. Include only the details needed to explain the finding and support the next action.

Use masked identifiers in routine tickets and reports where possible. Avoid including raw passwords, session cookies, full payment card details, or unrelated personal records in screenshots, chat messages, and notification previews.

Preserve context in approved systems

Keep a reference to the source record, the review date, the relevant identifiers, and the analyst’s assessment. Preserve enough context for another authorized reviewer to understand the evidence and the decision it supported.

Store necessary evidence in the systems your organization has approved for that sensitivity level. Clearly distinguish source material, third-party claims, AI-assisted interpretation, and conclusions reached by your own team.

Share for a defined purpose

Before sending a finding, identify the recipient, the action they need to take, and the evidence required to support it. Give a remediation team the information needed to secure an account; use an appropriately redacted summary for a broader business update.

When involving a supplier or external partner, use your organization’s approved contact and disclosure process. Record what was shared and why.

Review copies and retention

Apply your organization’s retention and access rules to copies held in your own tickets, exports, evidence stores, and reports. Review whether those copies are still needed as investigations close.

For questions about Scryer’s own access controls, storage, retention, or deletion processes, consult the applicable product and contractual documentation or request clarification from the Scryer team. Keep those service-specific requirements aligned with your internal handling process.

Next step: Return to All docs