Delivering sensitive numbers to the studio: control risks from the start.
Not every figure should go through email, and not everyone in the studio needs to see them.
Before sharing any sensitive numbers, you should sign a non-disclosure agreement (NDA) with the studio, limiting access to only those who need to know, and transmit files through a controlled access channel rather than email or regular messaging. For very sensitive information like undisclosed financials or data related to fundraising or mergers and acquisitions, additional layers of protection are needed: a data room with permissions, dynamic watermarks, and access logs. For the most sensitive parts, you can fill in a blank form that the studio prepares, without sharing the original numbers with anyone.
- NDA and controlled channels for proposal records
- Add a watermark data room for undisclosed financials.
- Guests filling in sensitive information themselves.
- send financial files via email or personal messages
- do not have an NDA and no agreement to delete data
When you hand over documents to the design studio, the challenge is not about having beautiful data or eye-catching slides. The challenge is knowing what you are handing over, to whom, through what means, and where that data goes after the project. This article from Sinh Vũ addresses each of those questions directly.
Classify sensitivity levels before doing anything.
Not every figure requires the same level of protection. Before delivering the file, you should determine which group your number belongs to:
- Number of disclosures allowed: Revenue that has been listed, industry market share that has been publicly reported, metrics mentioned in press releases. This group carries the least risk.
- Internal numbers: Profit margins, operating costs, undisclosed growth plans. This group needs to control access and NDAs.
- Number of non-disclosures: Data for fundraising, mergers and acquisitions (M&A), undisclosed valuations, or information related to unlisted securities. This group requires special protective measures.
Identifying the right group will help you avoid two opposing mistakes: overprotecting that slows down the project, or leaving vulnerabilities in the most critical areas.
The control steps in order
Sinh Vũ suggests an order of action based on increasing sensitivity:
- Sign an NDA before opening data. A non-disclosure agreement (NDA) must be signed and recorded before any files are exchanged. This is not a formality but a legal basis in case of incidents.
- Apply the need-to-know principle (least privilege). Only provide the necessary amount to the right page, for the right people in the studio who need to touch it. Do not provide a whole data warehouse when the studio only needs a few numbers.
- Transfer files through a controlled access channel. Avoid regular email and personal messages as you cannot control who views or forwards them. Use a sharing platform with account permissions and the ability to revoke access.
- With very sensitive data: use a virtual data room with watermarks and logs. A data room allows file-specific permissions, dynamic watermarks with viewer names, and access logs. If there's a leak, you will know which document was accessed.
- Agreement on data deletion or return after the project. Clearly state in the contract: after delivery, the studio deletes all source files containing sensitive numbers, ensuring that those numbers are not left in widely shared documents or long-term storage.
When to choose which direction
Only need an NDA and a controlled channel: capability documents, proposal presentation materials, most of which have been published or pose little risk if leaked. A light process that does not slow down the project.
Adding a data room, dynamic watermark, and access log: unpublished financial reports, fundraising documents, merger and acquisition materials. A layer of protection commensurate with the level of risk.
Customers fill in the numbers, studio creates the blank framework: this includes sensitive areas like profit margins, pricing, and equity. The studio does not need to see the actual numbers; customers fill them in directly on the final document after approving the layout.
Common errors and how to avoid them
- Sending financial documents via email or personal Zalo, without controlling who reads, saves, or forwards them.
- Provide the entire dataset when the studio only needs two or three numbers for a slide.
- No NDA, no data deletion clause, but internal financial files are shared before the contract is signed.
- After the handover, sensitive numbers still remain in the shared source file or in the common drive without permissions.
Provide only the minimum necessary information. The right number, the right people, at the right time.
Data security practices, need-to-know / least privilege.
Sinh Vũ's viewpoint
Sinh Vũ defaults to operating on a minimal principle: only accepting the exact amount needed for the required page. Sinh Vũ is willing to sign an NDA, receive files through controlled channels, and commits to processing or deleting data after the project ends.
The service boundary is also clearly defined: Sinh Vũ designs and presents visually, does not write the client's internal financial or legal content, and does not accept sensitive documents related to politics. This boundary protects both sides.
If you are unsure which numbers need to be protected at what level, Sinh Vũ is ready to sit down and define this together before the project starts. The cost of this step is nearly zero, while the cost of a leak is incalculable.
Decision checklist
Topic: Securing sensitive data when handing over documents to the studio. Sinh Vũ guide, sinhvu.com
Select each item you find appropriate, then print or save as PDF to take with you.
If you have marked most of the signs above, this is the time to discuss in more detail. Sinh Vũ can help you review and propose a direction.
References
EthosData: Virtual Data Room Security; Digify: Virtual Data Room Setup for Due Diligence; Sinh Vũ P4 (service boundaries, internal documents). Note: the security technical principles on this page are best practice guidelines; you should consult legal or data security experts before applying them to high-value records.
Frequently asked questions
Does the studio necessarily require an NDA before receiving files?
Yes, with any data that has not been widely published. An NDA is not just a formality, but a legal basis for you to take action in case of a leak. Sinh Vũ is willing to sign an NDA and commits to deleting or returning data after the project ends.
If you don't want to share real numbers, is there a way for the studio to still create the documents?
Yes. Sinh Vũ can create a document framework with empty fields, placeholders, or dummy numbers to present layout and design. After the client approves, you can fill in the real numbers in the final version without needing to provide the original data to the studio. This method is suitable for sensitive areas like profit margins, equity, or undisclosed valuations.
Does Sinh Vũ create internal financial and legal documents for businesses?
Sinh Vũ provides design and visual presentation for documents, but does not write internal financial or legal content for clients. Sinh Vũ also does not accept sensitive documents related to politics. This boundary is maintained to protect both parties.