Data Handling and Remote Access
How CraftedSQL works with customer systems, access and information
Working Model
Customer Systems Stay Under Customer Control
Data handling and remote access are part of many SQL Server consulting engagements. The work often requires privileged access to systems that support important business processes. Depending on the engagement, this can include database servers, configuration details, monitoring data, execution plans, error logs, backup information and, in some cases, data stored inside the databases.
CraftedSQL treats this access as a responsibility. Analysis and administrative work normally take place inside the customer-controlled environment, using access methods, accounts and permissions agreed with the customer.
Customer databases and business data are not routinely transferred to infrastructure controlled by CraftedSQL.
Remote Access
Remote Access Within the Customer Environment
Most engagements use remote access provided or approved by the customer. This can be a customer-managed VPN, a remote desktop environment, a privileged access solution, a support platform or another agreed connection method.
The customer remains in control of the environment and determines:
- which systems are accessible,
- which accounts and permissions are provided,
- when access is enabled,
- whether sessions are logged or supervised,
- and when access is removed.
CraftedSQL works directly on customer-managed systems whenever the engagement allows it. This avoids unnecessary data movement and keeps logs, execution plans and other technical evidence close to the system in which they were created.
Permissions
Access Is Limited to the Assignment
Administrative access must match the actual requirements of the engagement.
Some SQL Server investigations require elevated permissions. Configuration, availability, performance and recovery information cannot always be assessed through a restricted database account. Even then, unrestricted access is not the default.
CraftedSQL follows a least-privilege approach whenever the technical objective permits it. Access can be limited by system, account, role, time period or assignment scope.
If broader permissions are required, the reason must be clear before the work begins.
Data Transfer
Customer Data and External Transfers
CraftedSQL provides consulting, troubleshooting and technical analysis. Customers are not expected to upload production databases or store business data on a separate CraftedSQL platform.
CraftedSQL does not routinely collect, replicate or retain customer data as part of the service.
Some investigations require limited technical information outside the production environment. Typical examples are an execution plan, a configuration export, selected error-log entries, monitoring output or a diagnostic report.
Only the information needed for the analysis should be shared. Sensitive values should be removed, masked or reduced when this is technically practical. The transfer method must be agreed with the customer.
Production databases, database backups and substantial data extracts are not copied to systems controlled by CraftedSQL unless the assignment explicitly requires it. Such a transfer must be authorised and covered by the agreed contractual and security arrangements.
Documentation
Working Files and Documentation
Technical consulting creates working information. This can include notes, scripts, configuration findings, screenshots, reports and communication related to the engagement.
CraftedSQL keeps this material limited to what is needed to perform and document the agreed work. Reports and notes are prepared without reproducing business data, personal data, credentials or other sensitive content unless the technical context makes this unavoidable.
Credentials do not belong in general project documentation. Passwords, private keys and other authentication secrets must be exchanged and stored through methods agreed with the customer.
Temporary files are removed when they are no longer needed. If operational, contractual or legal reasons require longer retention, the applicable agreement defines how the material is handled.
AI Tools
Use of AI-Assisted Tools
Public AI services must not become an uncontrolled destination for customer information.
CraftedSQL does not intentionally submit customer credentials, production data, identifiable business records, complete database contents or confidential customer documents to public generative AI services for troubleshooting, analysis or content generation.
AI-assisted tools can support general technical research, language work or document structure. They may also be used with information that has been sufficiently abstracted. Before this happens, customer-specific content must be removed, generalised or replaced.
Customer restrictions on cloud services or AI-assisted processing apply throughout the engagement.
Production Changes
Remote Sessions and Operational Changes
Remote access does not automatically authorise changes to a production environment.
The engagement scope must distinguish between analysis, recommendations and implementation. Changes to production systems follow the customer’s approval, change-management and documentation processes.
Actions that could affect availability or recovery are discussed before execution whenever the situation permits it. This includes service restarts, changes to availability configurations, database recovery, security settings, patching, storage and backup procedures.
Emergency troubleshooting may require faster decisions. Even then, the intervention should remain limited to what is necessary and be documented afterwards.
Third Parties
Subcontractors and Third-Party Services
CraftedSQL is operated as an independent specialist consultancy.
Customer access is not passed to another consultant or subcontractor without prior agreement. If a third-party service is needed for file exchange, communication or remote access, its use must be transparent and appropriate for the sensitivity of the information.
Requirements for approved tools, service providers, data locations or subprocessors can be reviewed before technical access is established.
Confidentiality
Confidentiality and Contractual Safeguards
Technical access can expose confidential information even when no personal data is involved. This may include infrastructure design, security settings, operational weaknesses, business processes, application behaviour or details of an internal incident.
CraftedSQL treats this information as confidential and uses it only for the agreed engagement.
The contractual framework may include:
- confidentiality obligations,
- a data processing agreement where required,
- documented technical and organisational requirements,
- restrictions on storage or data transfer,
- agreed deletion or return procedures,
- and customer-specific access controls.
Additional safeguards may be necessary when the engagement includes broader access, personal data or information that must leave the customer environment. These points should be clarified before work begins rather than assumed from a general service description.
Completion
End of Access
Customer access should be removed when the work is complete or when it is no longer required.
At the end of an engagement, the customer can disable the accounts, remote-access permissions and credentials that were provided. CraftedSQL returns or removes customer-provided material and deletes temporary working copies that are no longer needed, subject to contractual or legal retention requirements.
Final reports, scripts and operational documentation remain with the customer.
In Practice
Data Handling and Remote Access in Practice
Responsible access depends on how systems are reached, which information leaves the environment and what remains after the engagement. The tools used during the work also matter.
The CraftedSQL working model follows these principles:
- work inside the customer-controlled environment whenever possible,
- avoid unnecessary transfers and copies,
- limit access to what the assignment requires,
- keep customer data out of public AI services,
- agree production changes before implementation,
- document technical findings without reproducing sensitive content,
- and remove access and temporary information when they are no longer needed.
Specific legal, regulatory or security requirements can be discussed before an engagement begins.
This page describes the general CraftedSQL approach to data handling and remote access. It does not replace project-specific contractual, legal, regulatory or security requirements.
Before Access Is Established
Questions About a Planned Engagement?
Organisations with specific requirements for remote access, confidentiality, AI-assisted tools, data processing, approved service providers or data location can address them before technical access is established.
Discuss Your Requirements