Innovare Records & Information Management (“Innovare,” “we,” “us”) is entrusted with sensitive physical and digital records belonging to our clients, including schools, government agencies, and businesses. This policy explains how we handle, transport, store, and dispose of client documents and data.
- Chain of Custody
All physical records handled by Innovare follow a documented chain-of-custody protocol from pickup through return or destruction:- Documents are packed into sealed, tagged bankers boxes at the point of collection.
- Each box is logged on a chain-of-custody / audit form recording what was collected, when, by whom, and its intended disposition.
- Every transfer of custody — pickup, transport, scanning, return, or destruction — is documented on the audit form with a timestamp and signature.
- Transport
When physical records must be moved between a client site and our processing location, they are:- Transported personally by Innovare’s owner or designated specialist — records are never left with a third-party courier or shipping service.
- Secured in a locked, enclosed vehicle compartment (lockable truck bed cover or van) during transit, out of public view at all times.
- Moved directly between the client site and our processing location, with no unrelated stops while records are in transit.
- Digital Transfer
Wherever possible, Innovare minimizes the physical movement of records by using an encrypted FTPS connection (FTP Secure)[1] for digital document exchange. Most[2] digitization work is completed via encrypted digital transfer reducing the amount of physical material that changes hands. - Storage
Physical records are stored only for the duration of the active scanning/digitization project. Records are kept indoors, in a secure, non-public area — never left in a vehicle, garage, or any exterior or publicly accessible space. Innovare does not retain client records on a recurring or long-term basis. - Return & Destruction
Once digitization is complete, physical records are either:- Returned to the client, or
- Securely destroyed, per the client’s records-retention instructions and applicable retention schedules.
- Every return or destruction event is logged on the chain-of-custody form, giving clients a complete, auditable record of what happened to their documents from the moment we took custody until final disposition.
- Digital Records & Data Security
Digitized files are transmitted and stored using secure, access-controlled methods. Access to client records — physical or digital — is limited to personnel directly involved in the project. - Client Rights & Questions
Clients may request a copy of the chain-of-custody documentation for their project at any time. If you have questions about how your records were or will be handled, contact us directly.
This policy describes Innovare’s standard operating procedures for document handling. It does not constitute a legal compliance certification (e.g., FERPA, HIPAA, CCPA). Clients with specific regulatory requirements should confirm applicable obligations with their own legal counsel; Innovare is glad to work within any additional handling requirements a client’s compliance program requires.
[1] To maintain strict compliance and data isolation on our server architecture, we utilize FTPS (FTP over TLS/SSL) via Port 21 with explicit encryption for external client gateways. While SFTP provides similar transport-layer security, standard SFTP access on our host requires master root system privileges. Using FTPS allows us to implement Chroot directory isolation for individual client sub-accounts, ensuring complete sandbox containment and zero cross-client data exposure.
[2] When physical records must be moved off-site, handling follows the secure transport procedures outlined in Section 2 of our policy.