Confirm who is making the offer
Navigate to the organization’s official site independently. Verify the legal entity, the representative’s business address and their role. An authentic company name can still be impersonated. Do not rely only on a messaging profile, a forwarded PDF or a link in unsolicited email.
Ask for a written scope
A credible proposal should explain what records it wants, why it wants them, who can access them and which legal entity pays. Ask whether there are onward recipients. Broad phrases such as all business data need explicit limits.
Treat access as a separate decision
Do not send passwords or grant broad admin privileges for a valuation. If a connector becomes appropriate later, review scopes, duration, export destinations, logging and revocation. Use a limited export or approved service account where your security team determines it is appropriate.
Watch for pressure and payment traps
Pause if the proposal requires an unexplained upfront fee, cryptocurrency transfer, personal credentials or secrecy from your own advisers. A large headline payment does not remove the need for identity checks, contract review and verified payment instructions.