Trust & confidentiality
Confidentiality starts with scope, access and evidence discipline.
Private-capital work can involve sensitive transaction, portfolio and technical information. Novarra’s operating principles are designed to minimize unnecessary data, control tool use and keep conclusions traceable to evidence.
Handling principles
Request less. Access deliberately. Keep the evidence trail clear.
Data minimization
Request only the information needed to answer the agreed investment or operating questions.
Authorized access
Sensitive materials should only be accessed after scope, authority and handling expectations are agreed.
No public client inference
Client, portfolio and transaction names are not used publicly without appropriate evidence and permission.
Controlled tool use
Engagements should identify which collaboration, analysis or AI tools are approved before sensitive material is processed.
Retention by agreement
Retention, return and destruction expectations should be defined for material supplied during an engagement.
Evidence traceability
Material conclusions should be traceable to the evidence reviewed, source-reported claims or clearly identified analytical inference.
AI handling
Sensitive information should not flow into unapproved AI tools.
AI can support analysis, but it does not change the confidentiality boundary or remove human responsibility for material conclusions.
AI-use principles
- Do not place client secrets or sensitive deal data into unapproved public AI services.
- Use AI only within the engagement's agreed confidentiality, data-handling and tool boundaries.
- Human reviewers remain responsible for material conclusions and client-facing deliverables.
- AI-generated analysis is treated as working material until validated against the underlying evidence.
Decision boundaries
Assurance reduces uncertainty. It does not eliminate risk.
Scope boundary
- Novarra is not a legal adviser, statutory auditor or accredited certification body unless a separately qualified role is explicitly contracted.
- Technology assurance and diligence reduce uncertainty; they do not eliminate technology, cyber, compliance or investment risk.
- The scope of reliance is defined by the engagement terms and the evidence available.
- Management and investors retain accountability for decisions and implementation.
Before sensitive access
Agree the handling model before the data room gets deeper.
A real engagement should define the approved evidence sources, collaboration tools, AI/tool boundaries, access route, retention expectations and authorized stakeholders before sensitive materials are processed.
Access
Who is authorized, what systems or repositories are in scope, and what is read-only versus interactive.
Tools
Which collaboration, analysis or AI tools are permitted for the engagement and under what conditions.
Retention
How supplied material, working files and deliverables should be retained, returned or destroyed.
Public trust layer
Website assurance should be inspectable too.
The public site now separates privacy, accessibility, responsible security disclosure and AI-use principles into concise statements that can be reviewed independently.
Last reviewed: 3 October 2026.