2 min lesson
Data handling: the questions security asks first
Give a practical answer to this. "A security reviewer asks for the exact data-retention window and whether their code is used for training. You're not certain of the current contractual specifics. What do you do?"
Step 1 of 2
Data handling: the questions security asks first
The very first question from a security team is almost always some form of "what happens to our code?" You must be accurate here, not optimistic. Getting a data-handling answer subtly wrong is the fastest way to lose a security reviewer's trust for the rest of the cycle. Two concepts take judgment on the call; the sourced posture itself sits in the baseline further down.
- Concept
- Data retention
- What it means
- How long, if at all, request data is stored
- How to handle it as an ADM
- State the posture plainly, confirm exact terms in writing and never improvise specifics
- Concept
- Training on code
- What it means
- Whether customer code is used to train models
- How to handle it as an ADM
- The single most common objection. Use the Privacy mode wording from the baseline below and keep it exact
| Concept | What it means | How to handle it as an ADM |
|---|---|---|
| Data retention | How long, if at all, request data is stored | State the posture plainly, confirm exact terms in writing and never improvise specifics |
| Training on code | Whether customer code is used to train models | The single most common objection. Use the Privacy mode wording from the baseline below and keep it exact |
Fluent and honest beats fluent and wrong. Reviewers remember which one you were.
Privacy posture and retention specifics can change and they're contractual. If you state a retention window or a training policy from memory and it's slightly off, you've handed the security team a reason to distrust everything else you say. The professional move is to give the accurate high-level posture, then say you'll confirm the exact terms in writing and bring the right internal resource. Confidence about where to get the answer reads as more credible than a guessed specific.