Data Security & Public-Record Handling
A factual explanation of what the public website handles, how engagement requirements are established, and how GCS approaches records that may be subject to public-records law.
GCS does not treat every document the same. Website inquiries, client operational material, and government records have different owners, purposes, and legal obligations. The applicable written engagement defines what GCS receives and what work GCS performs.
What the public website handles
- Contact and demonstration-request forms are processed by Netlify Forms.
- GCS uses those submissions to evaluate and respond to the inquiry.
- The public Nexus experience uses synthetic example data and is separate from client records.
Do not submit passwords, account numbers, protected health information, Social Security numbers, law-enforcement-sensitive information, or confidential records through a website form. A more sensitive exchange requires a separately approved method documented for that engagement.
Public records and client records
A government client remains responsible for determining whether a record is public, exempt, confidential, subject to a legal hold, or eligible for disposition. GCS does not make that legal determination for the client and does not answer a public-records request on the client’s behalf unless that work is expressly included in a written scope.
- Source records remain attributable to the source that supplied them.
- GCS analysis, annotations, and derived work products should remain distinguishable from the underlying source record.
- Retention, return, transfer, and deletion instructions must be documented for the engagement before sensitive client information is received.
- A request to perform work outside the agreed record-handling scope requires written approval before the additional paid work begins.
Public availability does not remove accuracy, retention, copyright, contractual, or privacy considerations. GCS will not describe a record as confidential merely because it is inconvenient, and will not promise disclosure when the client or applicable law requires review.
Security statements we can support
The public site uses HTTPS, restrictive browser headers, bounded form fields, and spam controls. The website privacy policy identifies the hosting and form processor and explains retention at a policy level. Engagement-specific access, storage, transfer, retention, and incident-response requirements must be agreed in writing and validated for that engagement.
GCS does not claim SOC 2, ISO 27001, FedRAMP, HIPAA, or any other security certification or regulated-environment authorization unless a current, verifiable certification or written authorization specifically applies. No website statement should be read as such a claim.
Questions or engagement requirements
For security, privacy, public-record, or engagement-specific requirements, please contact GCS before sending sensitive material. You can also review our Privacy Policy and written-scope approach.