Every Client, Their Own Perimeter: A Confidentiality Protocol for Link Building Research
A practical method for classifying information in each link building campaign, limiting access, controlling exports, and deciding which research can be reused.
Why Link Building Research Can Be Confidential
A list of potential publications or domains is not always just a collection of public data. The collection, the filters applied, and the decisions made can reveal a client’s strategy: which markets they want to prioritize, which competitors they monitor, what budget they have, or which topics they consider priorities. Unpublished commercial information and personal data about editorial contacts may also appear. That is why client data confidentiality for SEO agencies is not just about hiding documents. It means preventing information from being viewed, copied, or reused outside the authorized purpose and team. An isolated record may seem harmless; a complete research project can describe a campaign plan quite precisely.
- Sensitivity depends on the content as well as the context and the relationships between the data.
- The fact that a domain or contact address is public does not automatically make the associated strategy public.
- Confidentiality, personal data protection, and information security are related, but they are not identical concepts.
Classify the Brief, Prospects, and Decisions
Before starting prospecting, agree on what information will be handled and how it will be treated. The classification should be simple enough for the team to apply, but precise enough to distinguish a public reference from a strategic decision or personal data. There is no need to label every cell if the project and its documents already have a clear classification.
- Public or reference information: published information that can be accessed without credentials, such as the visible content of a website. You still need to check the terms of use and context before copying or redistributing it.
- Client-confidential information: brief, objectives, priority markets, selected competitors, budget, inclusion or exclusion criteria, timeline, and decisions about opportunities.
- Restricted information: credentials, personal data about contacts, unpublished commercial terms, and documents whose disclosure could cause specific harm. Pay particular attention to limiting who can access it and for how long.
- Derived information: scores, notes, filtered lists, and conclusions created during the research. Even when based on public sources, they may reveal the client’s judgment or strategy.
Assign Permissions Based on the Task, Not Convenience
Access should match the work each person needs to do. Someone researching opportunities may need to consult the criteria and record candidates, but not necessarily review the full budget or access every agency project. Someone approving a proposal may need to see the final selection and its rationale, but not all the contact data collected. Assign people to approve access, validate decisions, and resolve incidents. Review permissions when someone’s role changes, their involvement ends, or the relationship with the client concludes. If you work with external collaborators, confirm what information they need, how they will receive it, and what confidentiality obligations apply.
- Grant the minimum access necessary and avoid shared spaces between clients by default.
- Separate research, review, and approval responsibilities when team size allows.
- Use individual accounts and keep a record of who authorizes permission changes.
- Also check inherited access through folders, shared links, and user groups.
Protect Spreadsheets, Documents, Exports, and Handoffs
A private folder can lose its protection as soon as someone downloads a spreadsheet, duplicates a tab, or shares a link without checking its permissions. Treat every copy and export as part of the same confidentiality perimeter. Before sending a file, verify the recipient, the access granted, the included tabs, and whether there are comments, filters, or hidden columns that should not leave the team. During handoffs, share only what the next person needs to continue the work. Clarify what information is specific to the client, which decisions are still pending, and where the results should be stored. Avoid including personal data or commercial details in file names, email subject lines, or messages in channels with more participants than necessary.
- Store research in workspaces with appropriate permissions and review shared links regularly.
- When exporting, remove unnecessary columns, metadata, comments, and rows from other projects.
- Use an identifiable working version and avoid uncontrolled local copies.
- For a handoff, include the owner, date, status, data source, and next action; do not assume the recipient knows the restrictions.
- If personal data is involved, apply the measures and obligations relevant to the relationship and specific use, in addition to internal rules.
Decide When an Opportunity Can Be Reused
Reuse requires distinguishing between a public source and work done specifically for a client. The fact that a website is visible to everyone does not authorize sharing the brief, prioritized list, negotiated terms, contact notes, or the reason it was selected. Nor should you assume that an opportunity can be offered to another client: the contract, a prior commitment, a conflict of interest, or agreed exclusivity may all matter. Set a rule before the situation arises. For example, treat general information that can be verified again in public sources as reusable, but keep client-specific selection, analysis, and terms confidential. If another campaign could benefit from an opportunity, first check the applicable obligations and reassess its fit for that client. Do not transfer notes or explanations that reveal the first client’s strategy.
- Review the contract, scope, and commitments before sharing or reusing an opportunity.
- Distinguish verifiable data from the selection, negotiation, and assessment carried out by the team.
- Where appropriate, verify the information again using public sources and document the decision separately for the new project.
- If there is any doubt about exclusivity, conflict, or confidentiality, seek internal approval before proceeding.
Set a Retention, Archiving, and Deletion Cycle
Do not keep all research indefinitely just in case. Define what is retained while the campaign is active, what documentation must be archived when the service ends, and which copies must be deleted. The period and method depend on the contract, the agency’s justified needs, and applicable legal obligations; there is no single retention period that is appropriate for every situation. When a project closes, revoke access that is no longer needed, identify the versions that must be retained, and delete temporary copies according to the agreed procedure. Also check exports, download folders, and shared workspaces. If there is a retention obligation or an open incident, document the exception and restrict access for as long as it remains in effect.
- Assign an owner and a review point for each project.
- Distinguish documents that must be retained from unnecessary drafts and duplicates.
- Record deletion exceptions and the reason for keeping the information.
- Do not confuse archiving with leaving a file accessible to the entire organization.
Project Checklist
Before starting research, and whenever the team, scope, or destination of an export changes, review these points. This checklist does not replace the contract or a legal assessment when one is necessary; it helps make the operational perimeter visible and clarify decisions.
- Is information classified as public, confidential, restricted, or derived?
- Are prospecting criteria and decisions kept separate from reference data?
- Does each person have only the permissions needed for their current task?
- Do documents, spreadsheets, links, and exports include only authorized information?
- Does the handoff identify the owner, status, data source, and usage restrictions?
- Is there an approved rule for reusing opportunities and managing potential conflicts?
- Has it been decided what to retain, archive, and delete, and who will review it?
- Are important decisions and exceptions documented?
Frequently asked questions
Is a list of domains found in public sources confidential?+
Not necessarily every individual data point, but the selection, order, filters, notes, and their connection to a client’s strategy may be confidential. Check the contract and the agency’s usage rules before sharing the list.
Can an agency reuse a link building opportunity for another client?+
It depends on contractual commitments, exclusivity, potential conflicts, and the work done specifically for the first client. A prudent practice is to verify the public information again and not transfer the brief, negotiations, or confidential notes.
How should an export of a prospecting spreadsheet be protected?+
Limit the content to what is necessary, check recipients and permissions, remove unrelated columns or tabs, and avoid uncontrolled copies. If it contains personal data, also apply the relevant data protection obligations.
What should the protocol say about paid links?+
It should explain how paid collaborations are reviewed and documented, and how their nature is communicated to the parties involved. Google recommends appropriately qualifying paid links; depending on the circumstances, attributes such as sponsored or nofollow may be appropriate. A paid collaboration should not be presented as a guarantee of rankings.
Sources and references
- Google Search Essentials — Google Search Central
- Spam policies for Google web search — Google Search Central
- Qualify outbound links — Google Search Central