# How we protect your data

Our security controls, who else handles your data, and what we don't have yet. We are not SOC 2 audited, and we say so.

Source: https://golowprofile.com/security

Security

# We keep as little about you as the work allows.

A privacy service holds exactly the details its clients want hidden. So we treat every record we keep as a risk to reduce.

### Collect only what each step needs

We ask for details when a form requires them, not up front. The request form on this site never asks for your address.

### Encrypted and limited

Client files are stored encrypted. Only the person working on your household can open them.

### Deleted after setup

Once setup is done, we delete what Upkeep doesn't need. You keep your full report either way.

### No passwords, ever

You sign in to your own accounts. We never ask for, see or store a password or a one-time code.

### Signed permission first

We act as your authorized agent only after you sign a permission form, and only for the requests it names.

### Reports only on you

We only search for the household that asked us. We never run a report on someone else.

## Our controls, in plain terms

Family offices ask these questions before hiring any vendor. Here are our answers.

**We are not SOC 2 audited.** We're a small firm, and we'd rather say so than describe ourselves as "bank-grade." We'll pursue an audit when clients ask for one.

[Get the vendor packet](https://golowprofile.com/vendor-packet)

| Control | What we do |
| --- | --- |
| **Sign-in** | Hardware security keys on every account that holds client data. |
| **Documents** | Exchanged through end-to-end encrypted links, never by plain email. |
| **ID checks** | Photo IDs and live photos are checked by the verification provider. We keep the result, not the images. |
| **Deletion** | Setup details are deleted when the project ends. Requests that don't become work are deleted within 12 months. |
| **Confidentiality** | A mutual NDA comes with every engagement, before you share anything. |
| **Breaches** | If your data is ever exposed, we tell you within 72 hours of finding out. |
| **Access** | Only the founder and the named providers below. No other staff or contractors. |

## Who else handles your data

- **Cloudflare** hosts this site, our database, our email and the AI that sorts incoming messages.
- **A payment and identity provider** will process payments and photo-ID checks once checkout opens. We'll name it here first.
- **A licensed private investigation agency** will run the Exposure Review's searches under its license. We'll name it and its license number here before we take payment.

## This website

- Visit counts from Cloudflare Web Analytics, which uses no cookies and doesn't track you across sites. No advertising pixels or tracking cookies.
- The Stranger Test runs entirely in your browser. Your answers are never sent or saved.
- The request form sends your first name, email and the choices you make. It's stored with our hosting provider, Cloudflare.
- Requests and emails that don't lead to work are deleted automatically within 12 months.
- Only Go Low Profile can open our inbox, and a person reads every AI-drafted reply before it's sent. Cloudflare doesn't keep that text or train AI on it.

The [privacy policy](https://golowprofile.com/privacy) has the full detail.

---
Go Low Profile is not a law firm and does not give legal advice.