What customers allowed, and how we know it is accurate

Municipalities and utilities license their data to us for a service; they do not transfer it. I maintain a register that records, for each customer contract and product, what we may do with raw uploads, with outputs we compute for that customer and with anything derived across customers. Older agreements often say only that we may improve our services, a phrase that commercial colleagues read broadly and municipal solicitors read narrowly. I treat the narrow reading as the operating rule until the customer agrees otherwise. Our counsel interprets the contracts; my team translates the interpretation into access controls and product rules that engineers can apply. When a new product needs a wider permission, I ask for a separate, plainly worded addendum rather than relying on a renewal that quietly changes the terms.

A list of pipe segments is ordinary until each segment has coordinates, a condition grade and a nearby address. Location can reveal vulnerable infrastructure, private land, and the movement of field crews whose devices report position during a shift. I classify our datasets by what their locations could disclose, not only by whether they contain personal information. Canadian private-sector privacy law covers our commercial handling of personal information, and many public-sector customers bring their own provincial privacy obligations and expectations that their data stays in Canada. Utility network locations sit in a restricted tier with named access and logged queries. Field-crew positions are collected only while a work order is open, kept for ninety days and never offered to customers as a performance measure.

Imagery and point clouds collected by one municipality can teach a model that serves every customer. That is valuable, and it is also a use the original upload rarely contemplated. Our rule is that customer data trains a shared model only after the customer signs a separate consent, which states the data types used, where training takes place, how people and vehicle plates are blurred beforehand and what withdrawal means. Withdrawal stops future training runs, but it cannot remove what a released model has already learnt, and we say that in the consent itself. My team maintains the consented-data inventory, the evaluation sets and a record of which customers contributed to each model version, so a council or a utility can see exactly what its data was used for.

Survey and records products express position through different datums, projections and measurement methods. When two products describe the same buried valve, a difference of a metre may be a transformation error, an old record or a real discrepancy. I require every record to carry its source datum, the transformation applied and a positional-confidence class, and I treat unverified positions as a visible category rather than smoothing them into the main map. Acquisition due diligence now includes a data-lineage review of a sample of customer records. Engineering and the original product teams do the reconciliation; my team sets the standard and audits it. Decisions about whether to excavate or rely on a mapped position remain with qualified locators and the customer's own field staff.

We need to know which features surveyors and municipal technicians use, where workflows fail and which releases cause support calls. Public-sector customers need to know that our telemetry does not track their employees or expose their records. I designed our analytics around events rather than people: feature use, errors and timings, with user identifiers replaced by rotating keys and no map content captured. Customers can see a published list of events and switch telemetry off at account level without losing support. Product managers receive aggregated dashboards, not individual activity trails. The trade-off is real; some diagnostic questions take longer to answer. It has also made procurement reviews shorter, because a municipal privacy officer can read exactly what we collect, and why, before anyone signs.