50

I work as a software engineer in a software-only company, and I have found confidential information about a contract between my company and a client online. The document that I have found was on the server of one of our clients. I found it because I had to look up one of their installations and used google to do so. (They run at multiple web addresses and I used a google search to get the right one).

When doing this, I found out that they have a confidential document of my company publicly available. The document clearly states that it is confidential. It states the pricing information about the product we have made for them, such as development cost, installation cost, maintenance cost etc.

What could I do about this? Should I mention it to someone higher up in my company first? Or perhaps if the file were confidential for the client, the client could still decide it was okay to put it online.

As a note: I do not know how easy it is to find the document on their website. It just came up as the fourth result on google when looking for them.

|improve this question
  • 5
    "Or perhaps if the file was confidential for the client, the client could still decide it was okay to put it online?" - no, I wouldn't have thought so, particularly for things like costs. Your company will almost certainly consider it confidential too and not to be disclosed. – Rup Apr 18 '16 at 9:35
  • 4
    One thing to note is that you found this file through a simple Google search, i.e. you didn't navigate their website for it. There's a good chance that there are other documents in the same location that have the same confidentiality grade yet are also accessible by the general public. – Nzall Apr 18 '16 at 13:36
  • @Anonymous How many employees are in your company? – Anthony Apr 19 '16 at 0:44
121

Bring it to your manager.

Since it sounds like you're not in direct contact with this client or involved in the sales/offer process, this is above your pay grade. Whatever you do, do not directly approach the client about this. In most cases this won't be an issue and they'll react reasonably. But we've all known clients to which the word "reasonable" certainly didn't apply. If you knew all the players involved and their possible reactions you wouldn't have to ask this question. Since you don't, you should pass this on to someone who does. Your manager is the first person in that chain and he'll pass it along to whoever's qualified to handle this. That could be your company's legal department, sales team or a contact at the client. It will depend on your company and the relationship with the client.

It sounds like a simple administrative issue (misconfiguration of a document repository, document uploaded to the wrong server, ...) but even if it is it's not your responsibility to deal with it, only to report it.

|improve this answer
  • 10
    definitely pass it up the line in your own company – Kilisi Apr 18 '16 at 11:17
  • 17
    That last statement says it all and bears worth repeating: "...it's not your responsibility to deal with it, only to report it.". – RLH Apr 18 '16 at 12:52
  • There might be someone else (other than his manager) in his own company, to whom he could report it: for example, to Sales (who may deal with the client), or to the Legal or Information Security departments. – ChrisW Apr 18 '16 at 12:52
  • 6
    @ChrisW: If the OP knew about those options, he wouldn't have posted the question, and that answer can vary per company. – afrazier Apr 18 '16 at 13:08
  • 4
    @ChrisW OP's bosses would still want to be involved before the client does. – cst1992 Apr 18 '16 at 14:08
4

Please check your company policy document for reporting such issues.In any case I would suggest you to report the matter your immediate manager ,I agree with suggestion posted by Lilienthal but would like to add ".. Reporting may be your responsibility"

|improve this answer
  • I know that if I were in this situation, it would be my responsibility to at least report it. In fact, if I knew something and didn't report it, that would be grounds for dismissal. Having said that, I work in a different business area from the asker, and I've agreed to some strict business confidentiality conditions. – MBraedley Apr 19 '16 at 16:17

protected by enderland Apr 19 '16 at 19:45

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.