1 min lesson
Data handling - the questions security asks first
Tell someone how to act on this idea: "The questions security asks first."
Step 1 of 3
Data handling - the questions security asks first
The very first question from a security team is almost always some form of "what happens to our code?" You must be accurate here, not optimistic. Getting a data-handling answer subtly wrong is the fastest way to lose a security reviewer's trust for the rest of the cycle.
Learn more
Advanced table
Fluent and honest beats fluent and wrong
- Concept
- Privacy mode
- What it means
- A setting that restricts how request data is handled and retained
- How to handle it as an ADM
- Know it exists and what it changes; recommend it for sensitive orgs
- Concept
- Data retention
- What it means
- How long, if at all, request data is stored
- How to handle it as an ADM
- State the current posture plainly; never improvise specifics
- Concept
- Zero-data-retention
- What it means
- A posture where covered data isn't stored after the request
- How to handle it as an ADM
- A common enterprise requirement; confirm the current arrangement before promising it
- Concept
- Training on code
- What it means
- Whether customer code is used to train models
- How to handle it as an ADM
- The single most common objection - have a crisp, accurate answer ready
- Concept
- SOC 2 / compliance
- What it means
- Independent attestation of security controls
- How to handle it as an ADM
- Know it exists; route deep questions to the security/trust resource
| Concept | What it means | How to handle it as an ADM |
|---|---|---|
| Privacy mode | A setting that restricts how request data is handled and retained | Know it exists and what it changes; recommend it for sensitive orgs |
| Data retention | How long, if at all, request data is stored | State the current posture plainly; never improvise specifics |
| Zero-data-retention | A posture where covered data isn't stored after the request | A common enterprise requirement; confirm the current arrangement before promising it |
| Training on code | Whether customer code is used to train models | The single most common objection - have a crisp, accurate answer ready |
| SOC 2 / compliance | Independent attestation of security controls | Know it exists; route deep questions to the security/trust resource |
Fluent and honest beats fluent and wrong. Reviewers remember which one you were.
Privacy posture and retention specifics can change and they're contractual. If you state a retention window or a training policy from memory and it's slightly off, you've handed the security team a reason to distrust everything else you say. The professional move is to give the accurate high-level posture, then say you'll confirm the exact terms in writing and bring the right internal resource. Confidence about where to get the answer reads as more credible than a guessed specific.
Learn more
Optional practice
Practice: Data handling - the questions security asks first
QA security reviewer asks for the exact data-retention window and whether their code is used for training. You're not certain of the current contractual specifics. What do you do?