systemdesign.academyAI EngineeringFree lessonsSign inGet the course
  1. Home
  2. AI Engineering: Evaluation, LLM Ops and Security

Where this shows up in interviews

This idea carries a full system design question on its own. Each walks through the full answer.

  • →Design an AI Agent for Customer Support
Previous lessonAI Supply Chain Security: What You Import Runs as You

System Design

  • Foundation
  • Intermediate
  • Advanced
  • Capstone

AI Engineering

  • Foundation
  • Data, RAG and Agents
  • Evaluation, LLM Ops and Security

systemdesign.academy

  • Home
  • Glossary
  • Interview prep
  • Reviews
  • About
  • Pricing
  • Privacy
  • Terms
  • Refunds
  • Delivery
  • Contact
  • AI Security and Agent Safety
  • PII and Compliance for LLM Apps: Redaction, Retention, and Data Boundaries

    • AI Engineering · Security

    PII and Compliance for LLM Apps: Redaction, Retention, and Data Boundaries

    Free preview: the first part of this 15-part lesson.

    Already bought the course? Sign in to read the whole lesson.

    this lesson is part of

    AI Engineering

    Unlock this lesson and the 199 other paid lessons

    • 210 lessons in 16 chapters
    • 118 lessons built on a lab that really ran
    • An AI tutor beside every lesson that answers and draws
    • Lifetime access, every new lesson included

    $49 once, by PayPal

    See the AI Engineering course

    The rest of this lesson

    1. What Actually Leaves Your System on One Call
    2. Redact Before the Model, and Before the Log
    3. Regex Finds Card Numbers. It Does Not Find Names.
    4. A Redaction Pass You Can Run
    5. You Redacted the Prompt. Then You Logged the Raw One.
    6. What the Provider Keeps on the Other Side
    7. Where the Processing Happens Is Its Own Requirement
    8. Prompts and Outputs Are Records With a Clock
    9. A Retention Sweep You Can Run
    10. Deletion Has to Fan Out to Every Store That Copied the Data
    11. Deleting a Row Is Easy. Unlearning From a Model Is Not.
    12. The Regulatory Frame, Briefly
    13. The Compliant Design, and When It Is Overkill
    14. Knowledge Check

    read the rest of this lesson in

    AI Engineering

    Unlock this lesson and the 199 other paid lessons

    • 210 lessons in 16 chapters
    • 118 lessons built on a lab that really ran
    • An AI tutor beside every lesson that answers and draws
    • Lifetime access, every new lesson included

    $49 once, by PayPal

    See the AI Engineering course

    Continue this lesson

    in Security

    This lesson is part of the AI Engineering course. Unlock the full course, a separate one-time payment, for lifetime access.

    One-time payment. Lifetime access. No subscription.
    Global
    $49/lifetime

    One-time payment by card or PayPal

    Get Lifetime Access
    Foundation lessons free, try before you buy
    India Special
    India
    ₹999/lifetime

    One-time payment: UPI, card or netbanking

    Get Lifetime Access
    Foundation lessons free, try before you buy
    Every ML Platform lesson, Foundation to Advanced
    Real architecture diagrams with real tool logos
    MLOps, LLMOps, and data engineering in depth
    Quizzes with instant feedback
    Built and reviewed by senior engineers
    Lifetime access, all future content included

    Foundation lessons of this course are free, no payment needed. Try them now

    A Prompt Is a Data Export, Not a Function Call

    In December 2024 the Italian data protection authority fined OpenAI 15 million euros over how ChatGPT processed personal data, citing among other things a missing legal basis for the processing. You can read the regulator's own account on the Garante's site. Whatever you think of the specific ruling, the message to anyone shipping an LLM feature is direct: the text your app sends to a model provider is regulated personal data the moment it contains a name, an email, or a support transcript, and a regulator will treat mishandling it as a breach, not a rough edge.

    Engineers reason about a provider call as if it were a library function. Input goes in, a completion comes back. Legally and operationally it is nothing like that. The call leaves your trust boundary, travels to a third party's servers in some jurisdiction, may be retained there for a window you did not choose, and lands in your own logs on the way out. Every one of those steps is a place personal data now sits.

    Data lifecycle band showing one personal datum moving left to right through six stages, ingest, detect, redact or tokenize, store, serve, and delete, with a note that redaction at stage three shrinks storage, serving, and deletion downstream

    The supply-chain and provenance lesson tracked where your model came from. This lesson tracks the other direction: where your users' data goes once the model is running, what is kept, and how you get it back. The agent identity lesson answered who is allowed to act. This one answers a different question that legal and security teams care about just as much: what is the model allowed to see, store, and send onward.

    The rest of this lesson is the practical version of that question. Detect and remove PII before it crosses the boundary or hits a log. Understand what the provider keeps on the far side. Put a clock on everything you store, and make deletion actually delete, including the parts of your system where deletion is genuinely hard.