Confidentiality
Because it is. When you bring a subcontractor into a client engagement, you are the one who has to answer for how their data was treated. This page is written so you can forward it rather than paraphrase it.
Give me the narrowest access that lets me finish the work: one database role, one workspace, one folder. Not domain admin because it is quicker to set up. Revoke it when the task closes; I will remind you if you forget.
Working inside your tenant or your repo is better than shipping files around, and it means the data never leaves an environment you control. Where I do have to hold a copy, it stays on an encrypted disk and nowhere else.
The person you brief is the person who does the work. Nothing is passed to another contractor, no part of the job is offshored, and client data is never pasted into a public AI tool or any service you have not approved in writing.
On request or thirty days after the task closes, whichever is sooner, working copies are destroyed and I confirm it by email. If your client needs that confirmation for their own records, it is written to be forwarded.
Yours rather than mine, signed before you send me anything about the client, rather than after the scope is agreed. If your client requires a direct agreement with subcontractors, I will sign that too.
I do not approach agency clients and I do not accept direct work that reaches me through an agency engagement, during it or afterwards. I will put that in your paper rather than ask you to trust the sentence.
Regulated work
Health, financial, education and government data carry obligations that sit on top of anything on this page: a BAA, a specific retention rule, a residency requirement, a named-individual access log. Tell me before you send anything and I will either meet the requirement in writing or tell you I am not the right person for that particular job.
I ran a behavioral health practice for years, so this is familiar ground rather than a compliance page I copied from somewhere. It is also why I would rather decline a task than discover the obligation halfway through it.
Start
Ask them first. I would rather answer six questions now than have you wondering after the data is already with me.