FAQ · Governance & security
Can customer data go into large language models?
Whether data can enter a model depends on classification and red-line policy: public or internal de-identified data often fits private RAG; customer PII, contract text, and financial detail must be isolated or blocked. Build an access matrix and a 'what can enter the model' list before deploying use cases.
Key points
- Classify data: public, internal, sensitive, prohibited
- Define prohibited items: unde-identified customer info, unauthorized contracts, credentials
- Private deployment or enterprise API with data-residency policy
- Audit logs: who asked what, which documents were used
- Human review nodes: high-risk outputs reviewed before execution
How to do it
- Complete security and compliance screening in the workshop phase
- Produce access matrix and data red-line documentation
- Segment RAG knowledge bases by classification or permission
- Security review and sample audit before launch