Packaging, sign-off, and secure delivery

Once collection is done, three steps stand between you and a closed request: package, sign off, deliver.

1. Build the package

From the request detail page, build the delivery package. It bundles the collected artifacts along with a cover letter recording the reference, the request type, the date, and the systems searched. Review the contents carefully: everything in the package is what the requester will receive.

If anything needs redacting (third-party data, other customers in the same export), do it before the file goes into the package.

2. DPO sign-off

A DPO must sign off the package before it can be delivered. The sign-off records who approved and when, and it's your named-human checkpoint: the person confirming "we're disclosing the right data, to the right person, with the right redactions".

Packages awaiting sign-off appear in the daily digest, so they don't sit unnoticed.

3. Deliver

Delivery sends the requester an email with a secure link. Opening the link shows only the reference and request details. To see and download the actual files, the requester asks for a one-time passcode, which is emailed to their verified address:

• The 6-digit passcode expires after 15 minutes.
• 5 wrong attempts locks the code, and they simply request a fresh one.

This means a forwarded or intercepted delivery email is useless on its own. Access always requires control of the verified inbox at the moment of download.

Availability window

Downloads stay available for the number of days set in Settings (1 to 30, 14 by default). After that the link expires. If a requester misses the window, you can re-deliver.

After delivery

Close the request. The requester is invited to confirm the response resolved their request, and any feedback lands on the record.