AI and LLM Security
Sensitive Data and Tenant Isolation
We test whether one user's data can be accessed by another through conversation history, memory or caches. In multi-tenant products, we verify that one customer's data does not reach another.
What it is
AI applications create new data stores not present in classic applications. Conversation history and semantic caches that return stored answers to similar questions are examples. If these stores lack user or customer separation, data can pass between sessions. The test verifies that each request to these stores accesses only authorized data.
Scope
- Access control for conversation history and shared chat links
- Separation of user memory and personalization data
- Whether the semantic cache returns another user's answer
- Whether a customer filter is applied to every vector index query
- Where and for how long prompts and answers are stored in logs and at the model provider
- Masking of personal data in answers
The need
When organizations need it
- When an AI feature is added to a SaaS product used by multiple corporate customers.
- When a memory feature that recalls users from previous conversations is added to the assistant.
- When model answers start being cached to reduce costs.
Method
How we work
-
Data stores
We identify where the application stores conversations, memory, caches and indexes.
-
Cross-tenant tests
Using different customer and user accounts, we attempt to access one party's data from another.
-
Retention
We review how long prompts and answers are stored in logs and at the model provider.
-
Separation controls
For each store, we recommend identity-based filtering and masking controls.
Outcome
What you have at the end
You see through which paths one user's or customer's data can reach another. The separation and retention controls for each data store are specified.
Frequently asked questions
Does the model provider use our data for model training?
This depends on the provider's contract terms and the type of service used. In the engagement, we document which data is sent to the provider and how long it is retained.
Is it possible to avoid sending personal data to the model entirely?
In some cases, yes. Identifying information can be masked or pseudonymized before reaching the model. The impact on answer quality is evaluated for each use case.
AI and LLM Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting