The Public Records Act gives you 10 days. We help you answer with confidence.
Technical CPRA response support for California public agencies — locate responsive records, support review and redaction, and produce in native format. Built for teams without a dedicated IT or records department.
- The California Public Records Act requires a written response within 10 calendar days — and electronic records in native format when requested.
- Modern requests span email, file shares, text messages, and personal devices (City of San Jose v. Superior Court, 2017) — technically complex to locate and produce.
- Tech Bodyguard provides the technical muscle: locate responsive records, support review and redaction, and produce defensibly — your counsel makes all legal calls.
Locate · Review · Produceone mission.
We find the responsive records, wherever they live.
We stage records for review and execute redactions defensibly.
We deliver in the required format, with a documented log.
Everything public records responseactually requires.
Defensible Records Search
A documented, repeatable search methodology across your systems so responsive records are found — and the search itself can be defended.
Email & File-Share Collection
Technical collection from email, shared drives, and cloud storage with metadata preserved, so nothing responsive is quietly left behind.
Mobile & Personal-Account Collection
With agency authorization, targeted collection of work-related communications on personal devices and accounts subject to CPRA after the San Jose ruling.
Redaction Execution
We execute the technical redaction of exempt material your counsel identifies — permanently removing, not just masking, protected content.
Native-Format Production
Records delivered in the electronic and native format the request requires, with a documented production log for the file.
Documented Search Methodology
A written record of where we searched, how, and what was found — the defensibility documentation small agencies rarely have time to produce.
Voluminous & Recurring Requests
Surge capacity for large or repeated requests that rival litigation discovery, so a single demand doesn't overwhelm a small team.
Secure, Chain-of-Custody Handling
Encrypted, access-controlled handling with a chain of custody — essential when responsive records contain PII, personnel data, and exempt material.
What the CPRAactually requires.
The California Public Records Act (Gov. Code § 7920.000–7931.000) sets the rules public agencies have to answer to. Here's what it actually requires — stated accurately, without overstatement. Your counsel remains the authority on how it applies to any specific request.
- 01
It applies to nearly every local agency
The CPRA reaches state and local agencies — counties, cities, school districts, special districts, and other local bodies. If you're a public entity, you're almost certainly covered.
- 02
A written response within 10 calendar days
Agencies must respond in writing within 10 calendar days of receiving a request, stating whether disclosable records exist and will be produced, and the reasons. Note: this is the deadline for the determination and response — not necessarily for delivering every record.
- 03
One 14-day extension for unusual circumstances
In unusual circumstances the agency may extend the 10-day response window by up to 14 days, with written notice explaining why. It is a limited, defined extension — not an open-ended one.
- 04
Electronic records in native format when requested
When records are kept electronically and a requester asks for a specific format, agencies must generally provide them in that electronic format — including the native format the agency uses — where feasible.
- 05
Personal accounts and devices can be in scope
City of San Jose v. Superior Court (2017) held that communications about public business on personal accounts and devices may be public records subject to the CPRA — dramatically expanding the technical scope of a thorough search.
- 06
Cost recovery in defined circumstances
Where producing electronic records requires data compilation, extraction, or programming, agencies may be able to recover those production costs. The rules are specific — your counsel should confirm what applies.
Where agencies get stuck responding to records requests
Most California agencies field CPRA requests with small teams and no dedicated IT or records staff — and the records themselves have scattered far beyond the filing cabinet.
Small teams respond with no dedicated IT or records department to run the technical search.
Records live across email, shared drives, devices, cloud apps, and — post San Jose — personal accounts.
Manual search overlooks responsive material, creating legal exposure the agency never sees coming.
Redaction done wrong exposes protected information — or over-redacts and invites litigation.
What we handle,what you decide.
- Documented technical search across systems and accounts
- Collection with preserved metadata and chain of custody
- Technical execution of redactions counsel identifies
- Native-format production and a documented production log
- Search-methodology and defensibility documentation
- Secure, encrypted, access-controlled handling of sensitive records
- What records are responsive to the request
- What is exempt from disclosure
- What is privileged or must be withheld
- Every disclosure and production decision
- How the CPRA and its exemptions apply to the request
- All legal interpretation and strategy
Local, secure,predictable.
Built for California special districts
Many special districts are single-function organizations run by a five-member board with no dedicated IT — exactly the team this service is built for. A dedicated special-districts guide is on the way.
Security-first handling
We're a cybersecurity firm first. Responsive records — often full of PII, personnel data, and exempt material — are handled to our evidence-handling standard: encrypted, access-controlled, and logged end to end.
Supports proper cost recovery
A documented, efficient technical process both reduces staff burden and can support proper cost recovery where the CPRA allows it. Your counsel confirms what applies.
Local SoCal presence
On-site collection across Southern California when a request calls for it — no shipping devices out of the county and hoping the records survive.
Defensible methodology
Every search is documented so your agency can show it responded reasonably and completely — the defensibility record small teams rarely have time to build.
How a public records response engagementactually runs.
Scope & Locate
We work with your records custodian and counsel to scope the request, then run a documented technical search across email, file shares, collaboration tools, and — with authorization — mobile and personal accounts. You get a defensible record of where we searched and what we found.
Review & Redact
We stage responsive records for your team's review and support the redaction workflow. Counsel and the custodian decide what's exempt or privileged; we execute the technical redaction so protected information is permanently removed, not just masked.
Produce & Document
We produce records in the required electronic and native format and deliver a documented production log and search methodology — so your response is complete, on time, and defensible if it's ever challenged.
Scoped toyour caseload.
Per-request
Scoped and quoted for a single records request — the right fit for an occasional or unusually complex demand.
Managed records-response retainer
An ongoing retainer for agencies with steady request volume, with Tech Bodyguard acting as your outsourced technical records-response function.
Collection-only
Defensible technical search and collection when your team or counsel handles review, redaction decisions, and production.
Overflow & voluminous-request support
Surge capacity for large or recurring requests that would otherwise overwhelm a small team on deadline.
CPRA Response Consultation
A scoped consultation for your agency: where your responsive records live, how a defensible search and production would run, and how we support your team through the CPRA's 10-day response window — without drowning a small staff. Your counsel makes every legal call.
Public Records Response questionsworth asking.
Find out where your defenses actually stand.
Tell us about your business. We'll send you the Ransomware Reality Check, a personalized report with a letter grade and the three things to fix first. No sales call required — though we're glad to discuss the results when you're ready.