Sensitive Data Categories

Energy advisory involves data that requires institutional-grade handling.

CYPHR CARBON engagements routinely involve data categories that carry significant commercial, regulatory, and legal sensitivity. Reserve estimates and production forecasts are proprietary assets with direct valuation implications. Counterparty contract terms — tolling agreements, gas purchase contracts, power purchase agreements, transportation precedent agreements — represent commercially sensitive negotiating positions. Trading data and hedging positions carry MNPI risk for publicly traded operators.

For FERC-regulated entities, certain operational and commercial data is subject to Standards of Conduct requirements governing information sharing between marketing and transportation functions. CYPHR CARBON's data handling architecture is designed to respect these separations — maintaining firewalls that preserve compliance with affiliate transaction restrictions and FERC Standards of Conduct.

Every category of sensitive data accessed in the course of advisory work is governed by the same framework: minimum necessary access, strict segregation, no disclosure, and complete deletion at engagement termination.

Confidentiality Framework

NDA & Engagement Agreement Executed at Start

CYPHR CARBON executes a mutual non-disclosure agreement prior to any access to sensitive client data. The NDA governs all categories of energy-sensitive information — reserves data, production data, contract terms, trading positions, financial performance, and strategic plans.

Engagement agreements define data governance scope explicitly — identifying the categories of data to be accessed, the purposes for which they will be used, the protocols governing access, and the deletion requirements at termination.

For publicly-traded operators and affiliates of registered entities, MNPI handling protocols are addressed in the engagement agreement before advisory work commences. Energy companies with questions about data governance scope should raise them during the initial engagement conversation.

Core Governance Framework
Six commitments. No exceptions.
These are not policies that apply when convenient. They are the foundational architecture of how CYPHR CARBON handles every client relationship, every engagement, and every category of sensitive data.
01

Data Segregation

Client data is never commingled. Each energy engagement operates in strict data isolation — your reserves data, production figures, and contract terms are never accessible to, or analyzable alongside, any other CYPHR client. This isolation is structural, not procedural.

02

No Data Extraction

CYPHR does not extract, copy, or retain client data outside of the engagement scope. Data accessed for advisory analysis is used for that analysis and that purpose only. No client data is retained in any CYPHR system beyond what is necessary for the active engagement.

03

Irreversible Termination

Upon engagement termination, all client data in CYPHR systems is permanently deleted according to defined data destruction protocols. Termination is irreversible — no residual data retention, no backup carve-outs, no institutional memory derived from client data. You leave clean.

04

Minimum Necessary Standard

CYPHR accesses, analyzes, and produces outputs only from the data required to perform the specific advisory function. Scope is enforced — data access is governed by purpose, not by availability. Scope expansion requires explicit client authorization.

05

Exclusive Client Ownership

CYPHR will not provide any third party — including other CYPHR clients, partners, affiliates, or counterparties — access to any client's engagement data, outputs, or insights. All advisory work product belongs exclusively to the client organization.

06

Transparency

CYPHR will tell you clearly what data is being used, for what purpose, and under what governance framework. If you ask how your data is being handled at any point in the engagement, you get a direct answer — not a policy document redirect.

Data Lifecycle
How your data is handled across the engagement.
Three stages. Each governed by defined protocols. Energy-specific examples at each stage.
01
Onboarding
  • Mutual NDA executed prior to any data access
  • Engagement agreement defines data scope and governance protocols
  • MNPI handling procedures addressed for applicable entities
  • FERC Standards of Conduct firewall requirements reviewed
  • Data access provisioning limited to defined engagement scope
  • No reserves or production data accessed until agreements are in place
02
During Engagement
  • Minimum necessary standard applied at every access point
  • Reserves and production data used only for defined advisory functions
  • Counterparty contract terms handled as confidential — no disclosure
  • Trading and hedging data subject to MNPI handling protocols
  • FERC-regulated entity data subject to affiliate transaction firewalls
  • All advisory outputs marked confidential and client-owned
03
Termination
  • All client data deleted from CYPHR systems within 30 days
  • Data destruction confirmed in writing upon client request
  • NDA and engagement agreement termination protocols followed
  • Client retains all work product produced during engagement
  • No residual data in CYPHR institutional memory post-termination
  • Termination certificates available upon request
Absolute Commitments
What CYPHR will never do.
These are not terms subject to business judgment. They are unconditional commitments that govern every CYPHR CARBON engagement.

Never Sell or Commercialize Client Data

CYPHR does not sell, license, or otherwise commercialize client data in any form — aggregated, anonymized, or otherwise. Reserves data, production figures, contract terms, and trading positions are not CYPHR business assets. They are client property, governed by NDA and engagement agreement, and treated as such without exception.

Never Share Data Across Clients

Your organization's data — regulatory analyses, production forecasts, counterparty terms, financial models, strategic plans — is never shared with, accessible to, or disclosed to any other CYPHR client. Data segregation is structural and absolute. A competitor's engagement has zero visibility into yours.

Never Retain Data After Termination

When an engagement ends, client data is deleted. CYPHR does not maintain residual copies, backup archives, or institutional memory derived from client data after the engagement terminates. Reserves estimates, production histories, and contract terms do not persist in CYPHR systems post-termination. The clean break is a guarantee.

Never Exceed Engagement Scope

CYPHR accesses only the data necessary for the specific advisory functions defined in the engagement scope. Scope expansion — additional data categories, additional assets, additional business units — requires explicit client authorization. Data access does not expand without documented client approval.

Data governance questions? Ask them directly.

Energy companies have specific data governance requirements — regulatory, commercial, and competitive. Raise yours during the initial conversation, before any engagement commitment. We'll address them directly.

Start a Conversation About CYPHR CARBON

CYPHR CARBON data governance protocols are designed for energy advisory engagements involving sensitive operational, commercial, and financial data. Confidentiality obligations are governed by executed mutual NDA and engagement agreement. FERC-regulated entities should consult qualified legal counsel regarding Standards of Conduct compliance obligations. For publicly traded operators, MNPI handling procedures are addressed in the engagement agreement prior to commencement of advisory work. Data governance practices described on this page represent CYPHR's standard protocols; specific terms are governed by executed agreements. This page does not constitute legal advice. CYPHR CARBON is a division of CYPHR Group.