Privacy and information handling
The public intake may collect contact and organization details, the problem and decision described, known facts, unresolved questions, working hypotheses, authority basis, collection constraints, and optional context. Authorized staff use that information for screening and audit, professional and legal review, communication about the request, and protection of BSI² systems and users.
Access is limited according to role and purpose. Intake records are retained only as needed for screening, auditability, legal obligations, security, and any authorized client relationship. A submission does not authorize collection or investigative work, does not create an engagement, and does not create an operational case.
Sensitive records, credentials, financial account information, medical material, or evidence should not be submitted through the public form. Approved channels are established only after the request and access requirements are reviewed.