Holdout Labs

Sending data

How to send us your data

Six steps, in order. Nothing is sent until an NDA is in place, and the password never travels with the files.

Last updated 26 September 2026. Questions: [email protected].

Step by step

From NDA to confirmed receipt

  1. Sign the NDA first

    We sign your NDA on reasonable terms, or use our mutual NDA. Please send nothing sensitive until it is signed. We also confirm scope and fee in writing first.

  2. Prepare the files

    Put them in one folder in the data contract format: returns.csv for a returns-only audit; add instruments.csv, positions.csv and, if relevant, trades.csv for Tier 2. Anonymised is fine: call it “Strategy A”.

  3. Run the validator

    Download the free holdout_validate.py (Python 3.10+, standard library only) and run python holdout_validate.py your-folder. Fix any errors until it says PASS. It runs on your machine; nothing is uploaded.

  4. Encrypt the folder

    With 7-Zip (free): right-click the folder → 7-Zip → Add to archive. Choose archive format 7z, encryption method AES-256, tick Encrypt file names, and set a strong password (16+ characters).

  5. Send the archive

    Under about 20 MB: attach it to an email to [email protected]. Larger: share it from your own OneDrive, SharePoint, Box or Google Drive, with access limited to [email protected] and an expiry date.

  6. Send the password separately

    Never in the same email. Send it by text message or tell us by phone; we give you the number when the NDA is signed. We confirm receipt, and that the archive opens and validates, within one business day.

Please don’t

What not to send

  • Passwords, account logins, API keys or broker credentials, ever.
  • Anything before the NDA is signed, and anything in the intake form beyond a high-level description.
  • Account numbers, investor or client names, or other personal information about individuals.
  • Material non-public information about any company.
  • Data you are not licensed to share, such as vendor data whose licence forbids passing it on. Send your own returns and positions; we source public market data ourselves.
  • Code, exact rules or fund documents unless we have agreed they are needed. Most audits need only returns.
  • Unencrypted attachments, or the password in the same message as the archive.

What happens next

After you send

  • We confirm receipt within one business day, and tell you whether the files validate.
  • Files are kept in a dedicated folder on an encrypted drive, seen only by the founder, never in a code repository.
  • They are used only for your audit, and deleted within 30 days of delivering your report unless you ask us to keep them. We confirm deletion in writing on request.

The full policy is on confidentiality & data handling; the terms are in our terms of service.