What clients ask scan and BIM firms about data security: a starter checklist

Security questions come up in almost every serious scan or BIM job now, especially for plants, data centres, government and defence work. Here is a starting checklist of what clients tend to ask, so you can have answers ready. Please add what you've been asked.

Agreements

• Is there a mutual NDA, and whose paper is it on?
• Who owns the scan data and the model? Can you use it in your portfolio?

Where the data lives

• Which country is the data stored and processed in? Some clients require it to stay in-country (for example Australia, Saudi Arabia, the EU or UK).
• Which cloud services touch the data? Is anything processed offshore or by subcontractors?
• How long do you keep the data, and how is it deleted at the end?

Who can see it

• Who on your team, and which subcontractors, can access the files?
• Are any staff requirements involved (citizenship, clearances) for sensitive sites?

Tools and AI

• Is any AI or machine learning used on the data, and is the data used to train anything? Clients increasingly ask for a clear "no training on our data" commitment.

Certifications

• ISO 27001 or SOC 2 come up often for larger clients. If you don't have them, a clear written data-handling statement goes a long way.

What else have your clients asked for?