Confidentiality Policy

1. Overview

Confidentiality is a foundational principle of ASG Forensics' operational model. Clients frequently disclose sensitive financial, legal, personal, and business information during the course of an engagement, often in circumstances of significant stress or legal jeopardy. This policy describes the confidentiality obligations that ASG Forensics accepts, what clients are likewise required to keep confidential, and the limited circumstances in which disclosure may be necessary. This policy forms part of the contractual terms of every engagement.

2. What Information Is Treated as Confidential

The following categories of information are treated as confidential by ASG Forensics from the moment they are received or generated:

• The identity of the client, including name, organisation, contact details, and any associated individuals disclosed during the engagement.
• All details of the alleged incident or subject matter giving rise to the engagement, including wallet addresses, transaction hashes, account identifiers, and suspected perpetrator information.
• All evidence submitted by the client, in whatever format.
• The scope, methodology, and preliminary findings of the investigation at all stages prior to final report delivery.
• The final forensic report and all appendices, exhibits, and supporting materials.
• All communications between the client and ASG Forensics, including portal messages, emails, and notes.
• Any information about the client's legal strategy, intended use of the report, or proceedings that the client has disclosed.
• Payment information and billing records.

3. Who Within ASG Forensics Can Access Case Information

Access to case information is governed on a strict need-to-know basis. The following access model applies:

• Assigned analyst(s): Full access to all case evidence, findings, and communications relevant to their assigned tasks.
• Case lead / quality reviewer: Access for the purpose of reviewing analytical work, ensuring report accuracy, and signing off on deliverables.
• Management: Access limited to case status, billing information, and aggregate operational metrics. Management does not routinely access case evidence or detailed findings.
• Technical infrastructure staff: No access to case content. Infrastructure personnel may access metadata (file sizes, storage usage) solely for capacity management purposes, and only through role-based access controls that do not expose case content.
• All other personnel: No access to case information of any kind.

All ASG Forensics personnel who may access case information are subject to binding confidentiality obligations as a condition of their engagement with ASG Forensics. These obligations survive the termination of their relationship with the company.

4. Non-Disclosure Obligations of ASG Forensics

ASG Forensics will not disclose, share, sell, publish, or make available any confidential client information to any third party, except as expressly permitted by this policy or with the explicit written consent of the client. In particular, ASG Forensics will not:

• Use client case information for any purpose other than delivering the commissioned services.
• Reference, describe, or discuss client cases in marketing materials, case studies, or public-facing content without explicit written consent.
• Disclose the existence of an engagement to any third party, including the subject of an investigation, except as required by law.
• Share findings, evidence, or reports with any third party not authorised by the client, including law enforcement, regulators, or other agencies, except under the limited circumstances described in Section 7 of this policy.

5. Client Confidentiality Obligations

Confidentiality in an engagement is a mutual obligation. Clients are required to treat the following categories of information as confidential and may not disclose them to third parties without the prior written consent of ASG Forensics:

• Analytical methods and tools: Any information disclosed by ASG Forensics about the methodologies, software, databases, or technical tools used in the investigation must not be shared with third parties, published, or used to reverse-engineer ASG Forensics' processes.
• Analyst identities: The names, roles, or identifying details of specific analysts assigned to the case must not be disclosed to third parties, including opposing parties in legal proceedings, without ASG Forensics' consent. Where a report is submitted to a court or regulatory body, the analyst's credentials will be disclosed in the report itself, but personal contact details will not be included.
• Pricing and commercial terms: The specific fees, discount arrangements, or payment terms agreed for an engagement are commercially confidential and must not be disclosed to competitors or used in comparative public statements.
• Internal workflows and turnaround data: Any information about ASG Forensics' internal processes, systems, or operational timelines disclosed during the engagement must be treated as confidential.

6. Confidentiality of Analyst Identities

ASG Forensics takes the safety and privacy of its analysts seriously. Forensic analysts may become targets of harassment, intimidation, or retaliation — particularly in cases involving organised fraud, cybercrime networks, or adversarial parties with significant resources. For these reasons, ASG Forensics does not publicly identify the individual analysts responsible for specific engagements. Reports will include professional credentials and qualifications as relevant, but analysts are not required to accept direct contact from third parties, appear as witnesses without a formal legal process, or disclose personal information as a condition of a report's use. Clients who receive subpoenas or other legal instruments requiring analyst testimony must notify ASG Forensics immediately so that appropriate arrangements can be made through legal counsel.

7. When Disclosure May Be Required

Notwithstanding the foregoing, ASG Forensics may be required or permitted to disclose confidential information in the following limited circumstances:

• Legal obligation: Where ASG Forensics is compelled by a valid court order, search warrant, production order, or equivalent legal instrument to disclose records or evidence, it will comply with such compulsion to the extent required by law. ASG Forensics will, where legally permitted to do so, make reasonable efforts to notify the affected client prior to compliance.
• Regulatory duty: Where ASG Forensics has a statutory reporting obligation — for example, under applicable anti-money laundering or counter-terrorism financing legislation — confidential information may be disclosed to the relevant authority without prior notice to the client, as required by law.
• Prevention of serious harm: Where ASG Forensics becomes aware of information indicating an imminent, credible threat to the life or physical safety of an identifiable individual and no other avenue for preventing that harm is available, disclosure to the appropriate emergency services or law enforcement may be made.
• Client consent: Disclosure with the express prior written consent of the client.

8. Data Separation Between Clients

Each client engagement is maintained as a logically separate data environment within ASG Forensics' systems. No case data, evidence, findings, or communications belonging to one client is accessible to any other client or to personnel not assigned to that case. Technical access controls enforce this separation at the system level. This separation is maintained throughout the active engagement, the retention period, and the archival period, until secure deletion is performed.

9. Duration of Confidentiality Obligations

Confidentiality obligations under this policy are ongoing and do not expire upon the conclusion of an engagement. ASG Forensics' obligations of non-disclosure with respect to client information will continue for as long as the information remains confidential by nature and has not entered the public domain through the client's own disclosure or through a lawful process. Client obligations regarding analyst identities, methods, and commercial terms are similarly ongoing. Where a specific retention or confidentiality period is stipulated in a written engagement agreement between ASG Forensics and a client, that period governs over the default terms of this policy to the extent of any inconsistency.

10. Breach of Confidentiality

In the event that either party becomes aware of an actual or suspected breach of this confidentiality policy, the affected party must notify the other without undue delay. ASG Forensics maintains appropriate technical and organisational security measures to protect against unauthorised access, disclosure, or loss of confidential information. In the event of a security incident that results in unauthorised access to client data, ASG Forensics will follow its incident response procedures and notify affected clients in accordance with applicable data protection legislation.