First Scan Intake Packet: Share the Workflow, Not Secrets

Begin with a question small enough to answer

“Review the entire CRM” is not a first-scan question. Neither is “find every possible revenue leak.” Those requests are too broad to determine which data is necessary, who should approve access, or when the review is finished. A better question names one transition: Why do web-form inquiries sometimes lack an owner? Do estimate records preserve evidence of a customer-facing send? Are missed calls and web forms creating duplicate follow-up? Does an AI draft cross into customer communication without an approval receipt?

The question controls the packet. If the issue is owner assignment, exact street addresses and payment notes are unlikely to help. If the issue is time to first meaningful response, preserve trustworthy timestamps and time zones but remove free text that is unrelated to the timing decision. If the issue is duplicate detection, a stable pseudonymous key and a few carefully chosen matching fields may be enough.

Write the review question at the top of the manifest. Add what the first scan will not decide. It might identify missing evidence, inconsistent states, or an undefined owner; it will not establish legal compliance, employee fault, customer intent, lost revenue, or the performance of an entire account.

Take stock before you make a copy

The FTC’s business guidance begins with a simple discipline: know what personal information the business has, where it lives, how it moves, and who can access it. Its five-part model—take stock, scale down, lock it, pitch it, and plan ahead—is especially relevant when preparing material for an outside review. Creating a new export creates another copy, another location, another access path, and another disposal decision.

Map the source before exporting. Is the evidence in a form notification, call log, CRM row, shared mailbox, calendar event, spreadsheet, estimate file, or accounting record? Who owns the source system? Does the proposed sender have authority to share the specific fields for this purpose? Are there contractual, regulatory, customer, or employer restrictions? A convenient download button is not proof of permission.

When the question can be answered locally, prefer a derived worksheet over a full export. Create only the fields the reviewer needs, and keep a stable reference back to the authorized source so corrections can be reconciled without copying the entire record.

Redaction is a review process, not a black rectangle

Direct identifiers are the obvious starting point: names, email addresses, phone numbers, street addresses, account numbers, government identifiers, and payment details. They are not the only concern. A rare job description, precise timestamp, unusual location, long free-text note, photo, invoice number, vehicle plate, or combination of fields can make a person identifiable even after the name disappears.

Use stable review IDs such as abstract row keys that cannot be guessed from a phone number or email. Generalize a location to a service zone when the exact address is unnecessary. Convert an exact date to a relative sequence when the question concerns order rather than calendar time. Replace a person’s name with an authorized role—“intake owner,” “estimator,” or “reviewer”—when identity is not part of the issue.

Redact the source material rather than relying on the screenshot preview. Flattened image markings may be safer than editable shapes layered over text, but every file type requires inspection. Check spreadsheet hidden columns and tabs, comments, formulas, named ranges, revision history, file properties, metadata, embedded thumbnails, notifications, browser chrome, URLs, and unrelated windows. Reopen the final exported copy in a separate viewer and try to recover what was removed.

Keep a field only when it earns its place

Choose a bounded mix, not the easiest rows

A first scan is usually diagnostic rather than statistically representative. The sample should make different handoffs visible. Include at least one ordinary record that moved cleanly, one supported negative outcome, one duplicate or possible duplicate, one missing-owner or late-acceptance record, one missing-context record, and one record whose current status conflicts with its evidence. Exclude high-risk material that requires a separate handling decision.

Document the selection rule. “The last ten rows” may overrepresent one shift or source. “Ten rows that look broken” may exclude the normal comparison. A clearer rule might select a fixed date window, one source, and predetermined categories. If the sample is hand-picked, say so and limit the conclusion accordingly.

AI Cleanup Doctor’s current public starter scope is a 197-dollar AI Leak Scan for up to 25 redacted lead records. That is a maximum, not a target. Five carefully selected rows can be more useful than twenty-five copies of the same failure. Confirm the current scope and price on the live order page before purchasing because offers can change.

Some material should never enter the first packet

Also stop when the data involves a category the reviewer has not agreed to handle or the sender is not authorized to share: health information, financial records, education records, employment files, children’s data, privileged communication, trade secrets, identity documents, background checks, or information governed by a sector-specific contract or law. A narrow workflow question can usually be reframed with synthetic fields or a local review by an authorized person.

NIST SP 800-122 was written to help federal agencies protect the confidentiality of personally identifiable information. It is not a universal small-business compliance checklist, but its risk-based emphasis is useful: the protection should reflect the PII, context, potential harm, and safeguards. NIST’s voluntary Privacy Framework likewise helps organizations identify and manage privacy risk. Citing either source does not certify a packet.

Attach a manifest that another person can challenge

The manifest should list the review question, authorized business sender, intended reviewer, business purpose, sample rule, date range, source systems, exact filenames, record count, included fields, excluded fields, redaction method, residual risks, sensitive categories checked, allowed use, prohibited use, expected output, correction contact, retention question, deletion question, and stop conditions.

For each file, record a stable name and a checksum when practical so the sender and reviewer can confirm they are discussing the same bytes. Avoid putting secrets or personal data in the filename. If the packet changes, create a new version and explain the change rather than silently replacing the original.

A short boundary note is equally important. It may state that the packet is approved only to evaluate ownership and response evidence; it must not be used to contact customers, train a model, enrich profiles, make eligibility decisions, or change source records. The appropriate terms depend on the actual agreement and context.

Confirm the entire handoff lifecycle before sending

Ask where the packet will be transferred, who can access it, whether copies or backups are created, how access is authenticated, how corrections are handled, how long the material is needed, what the output will contain, how the packet will be returned or deleted, and what evidence of completion is available. Do not use ordinary email for sensitive material merely because it is convenient; the FTC’s guidance warns that unencrypted email is not a secure method for transmitting sensitive information.

The FTC’s Start with Security guidance also recommends limiting service-provider access to what is needed, putting appropriate security expectations in writing, and verifying rather than relying on assurances. The business remains responsible for deciding whether a provider and method fit the information and applicable obligations.

If no appropriate transfer method or lifecycle agreement exists, do not send the packet. Continue with a public-page review, synthetic example, local worksheet, screen-share controlled by an authorized person, or another approach that keeps the sensitive source in place.

Expect a bounded output, not a verdict on the business

A useful first-scan result should show the review question, sample and limits, evidence model, supported findings, conflicting rows, unknowns, hold and stop records, likely repair points, owner questions, and the smallest next action. It should not quietly expand into customer contact, account modification, employee grading, legal advice, a revenue guarantee, or a claim about every record outside the sample.

When the sample cannot answer the question, the right output is a missing-evidence note. That may recommend one safer field, one authorized local check, or a narrower question. More data is not the automatic answer.

Sources and method limits

• FTC: Protecting Personal Information—A Guide for Business — take stock, scale down, lock it, dispose securely, plan ahead, and avoid unencrypted email for sensitive information.
• FTC: Start with Security — data minimization, need-to-know access, restricted service-provider access, written expectations, and verification.
• NIST Privacy Framework — voluntary enterprise privacy-risk management framework.
• NIST SP 800-122 — federal guide to protecting the confidentiality of personally identifiable information.

Sources were rechecked on August 9, 2026. They support only the statements attributed to them. NIST SP 800-122 is directed at federal agencies, and the Privacy Framework is voluntary. Neither source certifies this packet or substitutes for applicable law, contract, policy, or qualified advice.