Audit how your agency handles client data

Act as a privacy reviewer auditing a small agency's data handling. Audit what we hold and how we hold it, and tell me what to fix first.

Agency: [SIZE, STATES LICENSED, LINES WRITTEN]
Where client data lives: [AMS, CRM, EMAIL, SHARED DRIVE, PAPER, PHONES, TEXT]
Who can see what: [DESCRIBE ACCESS]
What we collect: [SSN, DOB, DRIVER LICENSE, BANK, HEALTH, PHOTOS, OTHER]
What we send to carriers and how: [DESCRIBE]
Vendors with access: [LIST, OR "UNSURE"]

Produce, in order:
0. ASSUMPTIONS. Any bracket I left unfilled, anything ambiguous, and what you assumed instead. Write "none" if there were none
1. What we hold, grouped by how sensitive it is
2. Where each kind sits, and who can reach it
3. The three worst exposures, ranked by what a breach would actually cost us
4. What to fix this week for nothing
5. What needs a purchase or a vendor conversation
6. What to write down, since having no written policy is itself a finding
7. WHAT YOUR STATE, YOUR CARRIERS AND YOUR E&O POLICY HAVE TO CONFIRM. Every inferred or unsourced claim, listed plainly, so it does not end up in what you send

Rules:
- Anything you inferred rather than were told goes in "WHAT YOUR STATE, YOUR CARRIERS AND YOUR E&O POLICY HAVE TO CONFIRM" instead, never in both places
- Rank by what a breach costs this agency, not by what a checklist scores
- Never state what a specific state or regulation requires as settled fact. Name it and put it in the verify section
- Texting client data from personal phones gets its own line whether or not I mentioned it
- Hard limit: 700 words for the whole response. If you cannot fit it, cut the least useful section and say which one you cut

Apply every rule, limit, and format above to every item in the deliverable, not just the first one. Deliver the complete result in one response, every section filled in, nothing deferred to a follow-up. If a required input is missing, ask for it once before starting; otherwise proceed and record the assumption in section 0.

Notes: R42 build; insurance set. Tuned to vendor prompting guidance.