Handling sensitive evidence for an RUO merchant application

Separate general records from sensitive records

Classify records before collecting them. A website URL and catalog overview can usually be handled differently from an identity document, bank statement, or customer order export. Restrict sensitive files to the people who need them and keep a general index that points authorized staff to the correct record.

Verify the request and the delivery channel

• Confirm an unfamiliar request through your existing provider contact or case portal.
• Ask what information must remain visible and what the reviewer accepts in redacted form.
• Use the secure upload method the reviewer provides for sensitive records.
• Use order and transaction references where appropriate and keep full card numbers out of routine messages, screenshots, and documents.

Control copies after submission

Track where each copy is stored and who needs access during the review. Follow your retention and disposal process when copies are no longer needed. Keep the case reference and submission date in the index so staff can follow up without redistributing the underlying files.