Keeping one client's data out of another's report.

Somebody copies last month's report for one client to build the next one. They change the title, the logo, and most of the filters. One chart keeps the original account, and the report goes out.

It survives for a while because the chart looks perfectly plausible either way, and the client it went to has no way of knowing the figure is not theirs. That is the real shape of this risk. It is not an attack and it is not a permissions failure. It is a duplication with one field left behind.

Every copy of a report is another place a filter has to be correct. Build a roster of fifty clients as fifty copies and each chart has fifty chances to be wrong, checked by people working to a deadline.

The number of opportunities grows with the roster. The care available to check them does not, and it is lowest in exactly the month when the roster grew fastest. Any approach that depends on nobody making a copy-paste error is a plan to be wrong eventually.

The structural answer is one report that takes the client as an input, rather than many reports that differ by a filter. It is the same change the site argues for on efficiency grounds, and this is the version of the argument that carries real consequences.

Three layers, and the difference between them is what happens when somebody makes a mistake in the layer above.

• In the data, first

  One client per dataset, or a rule attached to the table itself. This is the only arrangement where a mistake made in the reporting layer cannot expose anything, because the rows were never reachable to begin with.

• In one parameter, second

  A single report taking the client as an input, so there is exactly one place the value is set and it is visible on the page rather than buried in a chart's configuration.

• Never on an individual chart

  A filter set per chart is the version that gets copied, and it is invisible to anybody reviewing the report because a correct chart and an incorrect one look identical.

The numbers are the part people check. These are the parts they do not.

A totals row that quietly sums across accounts. A dropdown listing every client you work with. An export returning rows the chart itself did not display. A panel of top campaigns across all accounts, left in from the template it was built from. A shared link with no restriction on it, still working long after the engagement ended.

Client names are themselves confidential, and this is the part agencies underrate. A client discovering your full client list is a commercial problem on its own, with no figures involved at all.

Three questions, and they take about a minute. Does every element on the page name the client it is supposed to. Does the headline total match what the client would calculate themselves, rather than something slightly larger. Is there anything on the page somebody could click, expand or export that would show them a list of everything else.

Run these when a report is first created rather than as a monthly review. The mistake is made at creation, and a monthly check finds it after it has already been sent, which is the point at which finding it stops helping very much.

The unit is the client. Everything scopes to that record, so a report is produced for a client rather than copied from another client's and re-pointed, which removes the step where the mistake happens.

Templates assigned to the agency arrive pre-wired to the chosen client's own tables. Each client's login is scoped to that client's own data, so no account can arrive at another client's view. On the Enterprise plan the portal also carries your own branding on your own domain. When an engagement ends, you remove that client's access.