Chapter 8: Collecting Customer Evidence and Protecting Confidential Information
A strong digital transformation achievement story requires more than persuasive writing. It needs reliable evidence showing what conditions existed, what actions were taken, and what measurable results followed. For technology providers, consultants, systems integrators, managed service providers, digital agencies, and implementation partners, that evidence often includes customer information subject to contracts, confidentiality obligations, privacy requirements, and security restrictions.
Providers should establish a secure evidence repository that supports credible recognition while protecting customers and other stakeholders. Evidence should be collected throughout the engagement—not reconstructed shortly before a case study, leadership review, communications campaign, or award deadline.
Collect Approved Performance Evidence
Useful evidence may include approved dashboards, performance reports, assessments, audit summaries, service records, customer surveys, testing results, implementation documents, and operational statistics. The objective is to preserve the materials that directly support the principal achievement.
For example, a provider claiming improved system reliability might retain approved availability reports from before and after implementation. A company reporting faster processing could preserve time-stamped workflow data. A cybersecurity provider might retain an authorized summary showing improvements in remediation time or control coverage without storing or revealing sensitive vulnerability details.
Not every available document belongs in the repository. Select evidence that is relevant, reliable, authorized, and safe to preserve.
Preserve Baselines and Final Results
Baseline evidence records the customer’s initial condition. Final or post-implementation evidence demonstrates what changed. Both are necessary for a meaningful comparison.
Providers should document the measurement period, source system, calculation method, responsible owner, and any exclusions or limitations. If the original baseline cannot be recovered, the organization should not create an unsupported estimate and present it as recorded fact.
Intermediate measurements may also be valuable. They can show whether improvement occurred gradually, followed a particular implementation phase, or required adjustments before the intended result was achieved.
Document Actions, Decisions, and Contributors
Quantitative results demonstrate value, but project records explain how the value was produced. Preserve major implementation decisions, milestones, obstacles, adjustments, and lessons as the engagement progresses.
Useful records might include an approved project timeline, decision log, milestone summary, change record, testing report, training record, or responsibility matrix. These materials can help establish which provider, customer team, partner, department, or professional made each contribution.
Avoid retaining unnecessary confidential discussions or personal observations. Evidence collection should be purposeful and governed by applicable contractual and organizational requirements.
Obtain Authorized Customer Testimonials
Customer testimonials can help explain why an achievement mattered. A useful testimonial may describe the original challenge, the provider’s contribution, the experience of implementation, or the result produced.
Providers should obtain written authorization before publishing a customer’s name, title, organization, or quotation. Approval should cover the final wording and intended use. Permission for a website case study does not necessarily authorize use in sales materials, media announcements, award nominations, or other contexts.
Customer references should not be altered in ways that change their meaning. If a quotation is shortened, the edited version should remain accurate and receive any required approval.
Use Public Sources Appropriately
Public announcements, approved case studies, customer webpages, reviews, regulatory filings, and other public references can support an achievement. Record the source, publication date, publisher, and direct link.
The fact that information is publicly accessible does not mean it can be reproduced without limitation. Providers should quote sparingly, attribute the source, link to original materials where appropriate, and comply with copyright, platform, and contractual requirements.
Public sources should also be verified. An outdated webpage, anonymous review, unsubstantiated social post, or provider-authored marketing statement may have limited evidentiary value.
Verify Metrics and Calculation Methods
Every important metric should be traceable to a credible source. Providers should know who supplied the data, which system produced it, what period it covers, how it was calculated, and whether the customer approved its use.
A claim of 40 percent improvement, for example, should identify the starting value, ending value, timeframe, and measurement method. Financial results should specify the currency and clarify whether amounts are realized, annualized, estimated, audited, or projected.
This verification process helps prevent accidental exaggeration and enables reviewers to understand the result accurately.
Secure Permission for Identifying Information
Do not assume that participation in a project grants permission to use a customer’s name, logo, data, results, or employee quotations. Contracts may contain confidentiality, publicity, trademark, data-use, or approval provisions that govern public communication.
Before using identifying information, determine what permission is required, who has authority to grant it, which materials are covered, where they may appear, and how long permission remains valid.
Logo use may require brand approval in addition to general customer consent.
Prepare Credible Anonymized Examples
When public identification is prohibited, providers can sometimes describe a customer in approved general terms, such as “a regional healthcare network,” “a multinational manufacturer,” or “a municipal agency serving approximately 300,000 residents.”
Anonymization should remove details that could indirectly identify the customer. Industry, location, size, technical configuration, and unusual project characteristics may reveal identity when combined.
An anonymized story still needs verifiable evidence. The provider should retain authorized internal documentation even when public materials omit the customer’s name.
Protect Sensitive Information
Evidence repositories may contain personal information, proprietary data, regulated records, financial details, internal performance data, or security-sensitive material. Collect only what is necessary and permitted.
Avoid including detailed system architecture, network configurations, credentials, access methods, unpatched vulnerabilities, incident-response procedures, confidential pricing, trade secrets, or information that could increase operational or cybersecurity risk.
Redaction should be performed before materials are shared—not left to an evaluator or external recipient.
Establish Approval and Retention Practices
Customer, legal, privacy, cybersecurity, executive, and communications reviewers may each need to approve different aspects of an achievement story. Build sufficient review time into the recognition process and maintain a record of approvals.
Store evidence securely with role-based access, encryption where appropriate, version control, backup procedures, and retention schedules. Remove or archive materials when authorization expires or retention is no longer justified.
Responsible evidence management protects customers while strengthening credibility. Providers can explore current Globee Awards programs, categories, eligibility requirements, achievement periods, nomination rules, deadlines, and potential recognition opportunities at GlobeeAwards.com.