What clients ask about data security, and how to answer

Security questions now come up on most serious scan and BIM jobs, especially plants, data centres and government work. What clients tend to ask:

• Agreements: is there a mutual NDA, and whose paper? Who owns the scan and the model?
• Where the data lives: which country it's stored and processed in. Some clients require it to stay in-country.
• Who can see it: your team, subcontractors, anyone offshore.
• AI: is any AI used on the data, and is the data used to train anything?
• Retention: how long you keep it and how it's deleted.
• Certifications: ISO 27001 or SOC 2 for larger clients. Without them, a clear written data-handling statement goes a long way.

What else have your clients asked for?