How do you handle customer data access and security in the first weeks of an engagement?

30-second answerSay your answer out loud first, then reveal.

Start the security and data access process on day one, because it's usually the critical path. Understand the customer's data classification and policies, propose the minimum data needed, use their approved environments (their cloud tenant or VPC, approved model endpoints), sign the necessary agreements (NDA, DPA), apply least-privilege access, redact or anonymise where possible, never copy data to personal devices or unapproved tools, and document everything for their security team.

Practical checklist

Agreements: NDA, data processing agreement, and confirmation of which model providers and regions are approved.
Data minimisation: request only the fields and sample size needed for the POC; anonymised or synthetic data where it suffices.
Environment: work inside the customer's cloud account or a dedicated isolated workspace; avoid moving data to laptops.
Access: individual named accounts, MFA, least privilege, time-limited access, access logging.
Model usage: enterprise endpoints with no-training and retention settings; regional processing if required (e.g. India for regulated sectors under data protection laws such as the DPDP Act).
Secrets: a vault or managed secrets, never keys in code or chat.
Security questionnaire / architecture review: prepare a clear data-flow diagram showing where data goes, what's stored, and for how long.
Clean-up: a documented data deletion plan at the end of the POC.

Why interviewers ask: FDEs handle sensitive customer data. Carelessness destroys trust and can end the account.

PreviousHow do you explain LLM limitations to non-technical stakeholders without killing enthusiasm?

Every expert started right here.

How do you handle customer data access and security in the first weeks of an engagement?

Practical checklist

Related