Breach notification mailing your firm directs.
When counsel owns the notification, the mail vendor becomes an extension of the engagement — which raises questions a price sheet does not answer. Who engages whom. What we will and will not say about your client. Which decisions stay with you. How it appears on the bill.
How does this work when our firm is directing it — engagement, confidentiality, control, and billing?
Three ways firms engage us.
All three are routine. Which one best supports a privilege or work-product position in your matter is counsel's judgment, not ours — we execute the paperwork either way and do not have a preference.
Firm engages, firm is billed
The firm is our counterparty. We invoice the firm; the firm handles cost recovery with its client. Common where counsel wants the vendor relationship inside the engagement and a single point of instruction. All communications and deliverables route to the firm.
Client engages, firm directs
The affected organization is our counterparty and is billed directly, while counsel gives production direction and holds proof approval. Common where the client's procurement or insurance requires a direct contract, or where the mailing cost is claimed under a cyber policy.
Subcontract beneath your engagement
We sit under a forensics or breach-response engagement as the fulfillment layer, invisible to the client if you prefer. Deliverables can be issued in your name with us named only where the affidavit requires the actual mailing party. See the IR partner page.
What does not change
The BAA where PHI is involved, the security controls, the proof-approval gate, and the evidence package. Structure changes who signs and who pays — not how the data is handled or who authorizes production.
How we handle a matter that may become litigation.
Assume every notification matter is a future exhibit. We operate that way by default.
Matter-scoped access
Least privilegeRecipient data is visible only to the production team assigned to your matter, under role-based access with activity logging. There is no firm-wide or account-wide view of matter data, and no analytics layer sitting across matters.
No subcontractors
In-house onlyComposition, print, insertion, and mailing happen in our own California and Texas facilities. No third party touches recipient data — which removes an entire line of vendor-chain discovery and an entire section of your client's risk questionnaire.
Communication routing
Your callOn request, all substantive communication routes through the firm rather than directly to the client, and production correspondence is addressed to counsel. We will also keep the matter name out of subject lines and use your internal reference instead.
No marketing use
NeverWe do not name clients, firms, or matters in marketing, case studies, or references without written consent. If you need that commitment in the engagement rather than on a web page, say so and we will paper it.
Documents in your name
On requestRecipient-facing mail carries the affected organization's letterhead and signature. Reports and correspondence can be addressed and formatted for the firm's file. The affidavit is the exception: it must accurately identify who performed the mailing, because that is the point of it.
Retention and holds
Per matterEach matter carries a defined retention and destruction schedule, and we will hold records beyond it on written litigation-hold instruction from the firm. Conversely, if you want data destroyed at the earliest permissible point, that is a schedule setting we honor and document.
Whether any communication or work product in a notification matter is privileged or protected is a legal determination for counsel. We do not assert privilege, and we do not structure engagements to manufacture it. What we do is avoid creating unnecessary records, keep the ones we must keep accurate, and follow your instructions on routing and retention.
The decisions that stay with counsel.
A production vendor should never make a judgment call that shows up later as a legal position. These are the gates, and none of them move without your written instruction.
| Decision point | What we do | What you decide |
|---|---|---|
| Letter content | Compose and proof | Every word |
| Version matrix | Build versions from your population map | Who gets which version |
| Exception dispositions | Flag duplicates, bad addresses, likely decedents | Drop, correct, or mail anyway |
| Suppressions | Identify candidates | Whether any record is suppressed |
| Mail class | Price and advise on trade-offs | First-Class, Certified, or Certified + ERR |
| Production release | Deliver proofs, then stop | Written proof approvalNothing prints without it — including on a 48-hour matter |
| Re-mails | Report corrected addresses | Whether to re-mail |
| Waves and splits | Produce and document each wave | Whether to mail in waves |
Documentation built for a regulator or a courtroom.
The reason a notification mailing is worth doing carefully is that two audiences may examine it later: a regulator asking whether notice was given on time, and a plaintiff's counsel asking whether a specific individual was notified at all. Both questions are answered by records created at the time of mailing, not reconstructed afterward.
- Affidavit of mailing identifying the mailing party, the matter, the counts, the letter versions, the class of mail, and the date of deposit — signed by the production manager of record, and notarized on request.
- Mailing manifest recording, per record, the address as mailed and the version mailed. This is the artifact that answers "was Ms. Doe notified, and what did her letter say."
- USPS acceptance documentation captured at deposit, which is what makes the mail date something other than our own assertion.
- Hygiene and reconciliation record showing records received, suppressed, mailed, and returned — the numbers tying together so an examiner does not find an unexplained gap.
- Declarant availability. Where a matter proceeds to litigation, we will provide a declaration and, if required, a witness who can speak to the production process from personal knowledge.
Detail on what each document contains is on the affidavit and proof-of-mailing page.
How it appears on the invoice.
Itemized for cost recovery
Invoices separate matter setup, per-piece production, postage, and optional services, with counts on each line — the detail a firm needs to pass costs through cleanly or to support a claim under a cyber policy. Postage is passed through at the actual rate paid and documented, never marked up.
One invoice per matter
Each matter, and each wave within it, reconciles to its own manifest and count. You are not decoding a consolidated monthly statement six months later when a client questions a disbursement.
Retainers and advances
For matters where the firm prefers not to carry the postage float — which on a large First-Class mailing is the majority of the cost — we will invoice postage in advance of the mail date against documented counts, then true up. Firms and IR practices that run recurring volume can hold a standing retainer instead; details on the panel onboarding page.
Quotes before work
Written, itemized, before intake — including on emergency matters. If the count changes materially, you get a revised quote before we produce against it, not a surprise on the invoice.
Questions firms ask before the first matter
Do you take direction from us or from our client?
From whoever the engagement names as the directing party, and only from them. If the firm directs, we will decline production instructions that come from the client without your involvement — including instructions to change letter content. That constraint is a feature; it keeps the approval record clean.
Two firms are on the same incident. Can you work with both?
Yes, as separate matters with separate access scopes, or as one matter with a designated directing firm. What we will not do is share one firm's file, counts, or correspondence with the other absent written authorization from the party that supplied it.
Will you sign our outside counsel guidelines or vendor terms?
We review firm-side paperwork routinely — vendor terms, confidentiality addenda, information-security schedules, insurance requirements. Turnaround on onboarding documents is one business day, and we will tell you plainly if a term is one we cannot meet rather than signing and hoping.
Can we get the evidence package years later?
Within the retention period, yes, on request from the firm. Beyond it, only if a litigation hold was placed. If you anticipate long-tail exposure on a matter, ask for an extended retention setting at engagement — it costs little and cannot be added retroactively once data is destroyed.
Do you provide expert testimony about mailing practices?
We provide fact declarations and witnesses to our own production process for matters we handled. We do not offer opinion testimony about industry standards or another vendor's work.
Our client wants to review the recipient list against our advice. Who wins?
You do, on production questions — we act on the directing party's instruction. But we will keep both of you informed of what we were told and by whom, because an undocumented instruction is a problem for everyone later.