Yes, it can happen. Records a public body holds may be requested by the public, and a vendor's security documents can become part of those records. Federal law has exemptions, and state and local rules differ. So label sensitive material, share only what is needed, and ask the buyer how requests are handled. This is not legal advice.
What FOIA.gov confirms
FOIA.gov explains that since 1967 the Freedom of Information Act has given the public the right to request records from any federal agency. Agencies must disclose requested information unless it falls under one of nine exemptions, which protect interests such as personal privacy, national security and law enforcement. Agencies should withhold only if they reasonably foresee harm to a protected interest or if disclosure is prohibited by law, and they should consider releasing partial records where possible.
That page covers federal agencies. State, school district and local government records usually fall under separate state or local public records laws, with their own rules. FOIA.gov does not describe those, so ask the buyer's records officer which rules apply.
Why this matters to a security vendor
Security packets can contain architecture diagrams, penetration test summaries, customer lists or unpatched issue notes. If those sit in a public body's file, a request could reach them. Exemptions are not automatic and are decided case by case.
Steps before you send a packet
- Ask first. "How does your records process treat vendor documents, and can we mark confidential material?"
- Share the minimum. A one page summary often answers the question. Hold detailed reports for a read only session or a secure portal.
- Mark clearly. Put a header on each page naming the document as confidential commercial information, with the date and version.
- Separate public from private. Keep a public version without sensitive detail.
- Ask for notice. Request that the buyer tell you if a request arrives, so you can respond within their process.
- Keep a log. Record who received which document and when.
What to share in each tier
| Tier | Examples | Handling |
|---|---|---|
| Public | Product overview, summary of controls, certifications you hold | Safe to release |
| Marked confidential | Detailed control descriptions, architecture overview | Mark and ask about records process |
| Restricted | Pen test details, open vulnerability notes, customer lists | Read only access or on site review |
Do not claim any certification you do not hold. Public records can make an overclaim easy to find.
A short note to put in the cover email
"This document contains confidential commercial and security information. Please let us know your process for public records requests and notify us before any release so we can respond."
It does not guarantee protection, but it puts the question on the record and gives both sides a path to follow. Keep a copy of what you sent.
What a buyer can do
Tell vendors early how records requests work, what markings you accept, and whether you will notify them. It saves time for both sides.
Also see NDA gated versus public trust center documents.
Quick check
Does FOIA apply to school districts?
FOIA.gov describes it as applying to federal agencies. Districts usually follow state or local rules. Ask the buyer.
Does marking a document confidential guarantee it stays private?
No. Exemptions are decided case by case. Marking helps but does not guarantee.
Sources
Last reviewed: 19 October 2026.
