How a matter runs, from the protective order to the certificate of destruction.

Plain words on what happens to your documents, in what order, and what you can check at each step.

Start a matter $2,500 per matter, fixed

Run personally by Kevin Matos, Tessera Strategy, Queens, New York.

Before the clock starts

Intake. You email the matter type, a rough document count and the deadline. You hear back the same business day.
Protective order first. I read the order and sign its own acknowledgment as a vendor before anything moves. If there is no order, we sign a mutual confidentiality agreement.
Engagement letter. A short fixed-fee letter. Counsel can retain me directly.
Transfer. Your firm's secure file share, an encrypted link I send, or an encrypted drive delivered by hand. Send the set as it was produced.
Receipt. I log the arrival, record a SHA-256 hash of exactly what arrived, and send the invoice.

The 72-hour clock

The 72 hours start at the last of three things: the full set received, the protective order signed, and payment cleared. The clock runs nights and weekends.

The three days of a sweepSame order on every matter

When	What happens	Where you can check it
Day 1	The set moves to the offline machine and is hashed again. Every file gets a document ID and a hash in the source index. Text is extracted. A sample of pages from every document type is checked by hand against the extracted text. The analysis starts.	Source Index tab; audit log
Day 2	The analysis finishes. The citation gate checks every finding. I start reading each finding against its source page.	Audit Log Summary tab
Day 3	Review finishes. Each finding gets a confidence level and a reviewer note. Unreadable pages and gaps go to Open Questions. The memo is written, quality checks run, and the package is assembled with checksums and delivered.	Findings tab; Open Questions tab; checksum file

If delivery by hour 72 is at risk, I call you before the deadline with the reason and a new time.

The citation gate

A finding cannot be written without a source reference. That rule is part of the structure, not a setting.

After the analysis, a verification pass checks every finding four ways: the document ID exists in the source index, the page exists in that document, a line is given, and the text at that page and line contains the figure. A finding that fails is blocked. It goes to Open Questions or is dropped, and it never reaches the Findings tab.

The gate makes sure every figure has a source. It does not make every reading right. That is why I read each finding against its page before delivery, and why every row tells you exactly where to look.

The audit log

Every processing step writes to an append-only log as it happens: unpacking, the manifest, extraction, the page check, the analysis, the citation gate, and any re-run. Lines are added. Nothing is edited or deleted afterward.

The log comes with the package, with a hash of the log recorded at the end of each run. The workbook's Audit Log Summary tab lists each run and, for your matter only, how many findings the system proposed, how many the gate blocked, and how many changed or were withdrawn in review. Those are counts, not accuracy claims.

If someone asks how a number was produced, the answer is a line in the log and a page and line in the source.

Data handling

Offline. The analysis runs on dedicated hardware with no internet connection. No document, excerpt or metadata is sent to any cloud model or third party.
One matter, one encrypted volume. Each matter gets its own encrypted volume, created before any document arrives.
One person. I handle every document myself. There are no subcontractors.
Chain of custody. Receipt, transfer, every processing run, delivery and destruction are logged with dates, counts and hashes. The custody log holds no document content, so it can be kept after the set is destroyed.
The order controls. If the protective order and the engagement letter ever disagree, the order wins.

Delivery, walkthrough and corrections

The package. The workbook, the source index as CSV, the memo as PDF, the audit log, and a checksum file covering each of them.
The walkthrough. 30 minutes on how to read a citation, what the flags mean, where the records conflict, and how to use the log.
Corrections. For 5 business days after delivery, send any figure that doesn't match its source, with the finding ID. I check it against the page and line, correct the workbook, log the correction and send a new version. Row IDs never change between versions.

The certificate of destruction

The business day after the corrections window closes, the set is destroyed: the documents and every copy and derived file I hold, including extracted text, indexes, working files and my copies of the deliverables.

Method. Purge, as defined in NIST SP 800-88 Rev. 2, by cryptographic erase of the matter's encrypted volume or the drive's own sanitize command.
Your drives. Returned to you, or sanitized with your written permission.
The certificate. One signed page listing each item of media, the method, the tool, how it was verified, and the date.
What I keep afterward. The certificate, the custody log (dates, counts and hashes, no content), the engagement letter and the invoice.
If your order requires return instead of destruction, I follow the order.

Sources

NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025) (csrc.nist.gov)

Keep reading

Sample workbook: every tab, built from an invented matter, with each row tied to a page and line.
Common questions: privilege, cloud AI, Frye and Daubert, corrections, price and timing.
For matrimonial attorneys: transfers set against the net worth statement and the filing and service dates.
For estate and trust litigators: the fiduciary's account checked against the bank and brokerage records.
For forensic accountants: a cited first pass of the production for your team to verify and build on.
Evidence Sweep overview: what you send, what comes back, price and terms.

Free and vendor-neutral: a one-page protective-order checklist for any outside document vendor. Email for the checklist.

Start a matter

Email the matter type and rough document count. You will have a reply the same business day.

Send no documents yet. Matter type and a rough count is enough. Open a prefilled email, copy the address below, or go to Start a matter on the main page.

[email protected]

929-487-7415