Before you begin
Identify the proposed pilot scope and the data categories your organization would place on the governed path. Review the draft agreement and processing terms with counsel before enrollment.
- Use a non-sensitive initial inquiry.
- Name who may authorize inspection, activity access and any separate learning consent.
Supported scope and current status
The current /privacy notice distinguishes transient hosted inspection, decision metadata, a separate encrypted employee activity store and contact records. It states that durable raw-content custody for evidence or holds is not implemented.
- Read /privacy for current retention windows and disclosed gaps.
- Read /subprocessors for the listed processors and their status.
Compare this path with the published coverage table and the coverage guide.
Set up the path
Before a customer path is enabled, agree the exact policy, source, recipients and applicable processing terms. Treat learning opt-in as a separate purpose-specific choice; ordinary protection enrollment does not imply consent to training.
- Record the organization’s approved scope and recipient list.
- Ask RedactWall about unresolved terms or retention questions before data flows.
Use the workflow
Use the governed path only for agreed content. A rights or contact request should identify the requester and requested record class without embedding prompt bodies or customer records in the initial message.
- Use the public contact path with minimal detail.
- Ask for the supported treatment and its actual readback.
Verify the result
Read the current notice and any actual account or treatment response. A deletion request, suspension, backup expiry or source withdrawal does not automatically prove destruction across every store.
- Check the specific record class and time period.
- Request a fresh status for any held, backed-up or separately processed copy.
Coverage references: 17 requirements, 0 currently passed
This guide is bound to 17 requirements in RedactWall's acceptance crosswalk, which is maintained internally and not published. A requirement counts as passed here only after current evidence for every bound scenario and authority has been published; none has been published yet.
See the public verification overview and the documentation coverage guide.
Denials and recovery
If a request cannot be authenticated or a hold blocks treatment, ask for the specific refusal and next step. Do not send identity secrets or raw content to bypass a failed contact flow.
- Keep the support reference and minimal description.
- Repeat a request only after the affected source or authorization is clarified.
For customer-side next steps, read Recovery and support.
Billing and integration handoffs
Contact and authentication providers, cloud hosting and the customer’s own source systems have distinct handling. Commercial conversion does not change the published protection and activity-store distinction.
- Review /subprocessors before adding a new route.
- Check /pricing for the commercial path without treating payment as processing consent.
Limits to keep in view
A draft pilot agreement with processing terms has been prepared for counsel review. It has not been reviewed by counsel, agreed or signed, and it must be reviewed and agreed before any enrollment. Pilot request and approval records are kept for the life of the service today; there is no current destruction certificate. The live learning-collection path has not been independently exercised.
- Do not infer an approved data-processing agreement from this guide.
- Use the actual /privacy notice as the current retention authority.
Review the current Disclosures before relying on a capability.