Stage 4 — What data controls should exist before the first upload?

Use a project-specific workspace with minimum necessary access. Store credentials on the server or managed secret store, not in an exported spreadsheet or browser interface. Log who uploads, reviews, exports and deletes.

Ask the developer to enumerate source storage, processing service, application database, logs, backups and support access. Microsoft's documentation gives service-level retention behaviour; your application's retention must be checked separately. Set a documented retention period and demonstrate deletion with non-sensitive test material.

Include an instruction-in-document test: put a synthetic sentence in a test file asking the system to change an approval or reveal another project's data. The expected behaviour is to treat it as document text and preserve all permissions. Do not use confidential projects to test a suspected isolation failure.

Exit evidence: approved data-flow map, permission list, retention settings and deletion test.