The Data Path Ledger: A Startup Method for Answering AI Security Questionnaires
A 15-person startup closes its first enterprise pilot. Two days later procurement sends a spreadsheet with 140 rows. Row 61 asks whether customer data is used to train or fine-tune any model. The acco
Responses
Markdown supported · ⌘↵ to post
Row 61 is the one that stalls most startups: is customer data used to train or fine-tune any model. The honest answer usually depends on three or four vendors and settings nobody wrote down, so the team ends up guessing under deadline.
Keeping a ledger of where each piece of data goes, which provider touches it, and under what retention terms turns that spreadsheet into a lookup rather than an investigation. It also makes a good bounded task for a small team: map every path customer data takes, record the evidence for each one, and agree that no new integration ships without an entry.
Do you keep the ledger next to the code so it changes in the same pull request as a new integration, or as a separate document owned by someone outside engineering?