Someone writes in and asks for everything you hold about them, and under UK GDPR a one-month clock starts (a calendar month, not a working one). Disclose runs the request as a case in Foldr: it searches the shares and mailboxes you point it at, keeps the review and redaction on the record, and delivers a bundle you can stand behind.
Two minutes: the clock starts, the shares and mailboxes are searched, the redactions are reviewed, and the pack goes out as a secure link with the decisions behind it.
Disclose comes with Foldr Governance, so a request lands on the files, permissions and audit trail you already run. Nothing is copied into a separate tool; the case comes to where the documents live.
Disclose ships with the UK regimes built in (subject access under UK GDPR, freedom of information, and social-housing tenant information requests), each with its own statutory clock. On a subject access request that’s a calendar month to the corresponding date. Verifying the requester’s identity stops the clock, and an extension needs a recorded justification with a hard ceiling. No spreadsheet of dates on the side.
Disclose searches every share that’s indexed, including file servers and NAS boxes that cloud-only tools can’t reach, and the manifest lists any share it couldn’t search and why. Scanned paper counts too, once it’s been through OCR. On a big scanned estate that’s the slow part, and we’d rather you knew before the first request than during it.
Collect from Microsoft 365 and Gmail mailboxes, but only ones on an allow-list your administrator controls. Every mailbox search is audited: what was asked, of which mailbox, and what came back.
The search manifest records what was searched, what matched, and which places returned nothing. When someone asks “did you really look?”, the answer is a document rather than a recollection, and every decision on a case is recorded in a log that only ever grows.
Work the results in one review table, or decide in the viewer while reading. Keep, exclude, record why, and someone senior signs the release off before it leaves.
Redactions are applied to a converted copy, removing the text underneath rather than drawing a rectangle over it, and document metadata is scrubbed on the way out. You can also type a phrase or draw a box and give it an exemption reason; the marks are burned into the copy, never the original. If your organisation has switched AI suggestions on, Grace proposes what to cover, and an officer approves every one.
Put a request form on your website and each submission opens a draft case for your DPO to claim, with the clock not yet started. (Forms comes with Business and Enterprise.)
Records that live in your MIS or safeguarding system come in as that system’s own export, logged by name, so the search manifest shows where each came from. It’s an export you drop in rather than a live connection.
Housing associations get the tenant information request type, with refusals, letters and reviews on the same record.
Four stages, all inside the case, all on the record.
Log the request and the due date is computed for you, the way the guidance counts it. Need to check the requester is who they say they are? Asking for ID stops the clock, and verifying them restarts it, with every transition recorded.
Point the case at indexed shares and allow-listed mailboxes and let it gather everything that mentions the subject, wherever it lives: SharePoint, OneDrive, Gmail, the SMB server in the back office, scanned letters included once they’ve been through OCR. The manifest keeps the score, including the places that returned nothing.
Every collected item gets a decision with a reason attached. Third-party details are redacted on a converted copy, never the original, with Grace suggesting candidates if you’ve switched that on and a person confirming each one. Sign-off gates the case before anything leaves.
Generate the disclosure bundle with its manifest of what went out and what was withheld, and deliver it through Foldr’s secure links to the named recipient, instead of a password-protected ZIP and a second email with the password.
Disclose rides the Governance machinery: the review engine, the activity log, the permissions model you already trust. A subject access request stops being a scramble across inboxes and becomes a workflow with a deadline, run by the people you’ve nominated and nobody else.
About GovernanceA school’s SAR arrives about a pupil, with safeguarding tangled through it; a council’s request arrives as a freedom of information request with exemptions to apply. Disclose treats every keep, exclude and redaction as a recorded human decision, so whoever fields these (often the DPO, sometimes the school office) can show exactly how the answer was made.
Estate search runs on the same index as Search. Grace reads the same documents when suggesting redactions. Governance supplies the sign-off and the record. Nothing about a disclosure happens in a side system.
Try it free for 30 days, no credit card. Or get in touch about self-hosting.
