A previous note in this journal described discretion as a structural property rather than a behaviour. This is the technical companion. What does that structure look like in actual office practice?
Three layers.
The communication stack
Different conversations live on different channels.
- Standing matters — the principal's calendar, recurring requests, partner introductions, the monthly read-out — travel by encrypted messenger between named individuals. The messenger we use is end-to-end encrypted, has no server-side message storage, and is configured for ephemeral messaging (messages auto-delete from both endpoints after a configured window). The principal and the chief of staff hold the configuration.
- Sensitive matters — a medical second opinion, a sensitive acquisition, a difficult personal matter — are not on the messenger. They are on a private phone call or in person. We do not write them down on a device.
- Routine logistics — a restaurant booking, a flight confirmation — can live on regular email because the information is low-sensitivity and the audit trail has practical value.
The principle: the more sensitive the matter, the less writeable medium it lives on. The most sensitive matters are not written down.
Document handling
Documents the desk holds — passport scans, immunisation records, gift register, the principal's dossier — live in an encrypted vault. The vault is held under the principal's authority; we hold operational access through named individuals, not through shared credentials.
The vault is per principal. No shared workspace. No "client folder system" the way a law firm runs. A principal's documents are in a vault that the rest of the desk does not see, and that the desk does not show to anyone outside the named team for that principal.
When a principal ends the relationship — voluntarily, or because of a decision either side has made — the vault is returned and the desk's copies are destroyed. We give a written confirmation.
Compartmented teams
No single concierge holds the full picture of a mandate. A senior coordinator above the cells has read access to the whole, but the cell-level operators do not. The travel coordinator does not see the medical brief. The medical concierge does not see the auction file. The aviation desk sees aviation, not residential staff.
The principle: any single breach should leak the smallest possible slice. The architecture is designed so that the worst case of a careless conversation is recoverable.
What we do not do
We do not maintain a "client list" on a desktop spreadsheet. We do not name our principals in conference talks. We do not respond to journalists with anything other than "we do not comment on client matters" — a phrase we have used for years and will continue to use. We do not have an Instagram account that posts about our work.
We do not say which principals we work for, even privately, even to friends. The decision is the principal's to share, not ours.
Why this is concierge work
Because for a household that lives publicly, the staff that supports the household is, in practice, the next line of privacy. We do not "support" the principal's privacy from the outside. We are part of the household's architecture of privacy.
That architecture is the most underrated thing we offer.
To discuss a confidential mandate, contact us privately. All initial conversations are under NDA.
