Skip to main content
Implement safeguards to prevent cross-customer data exposure

Control activities

Typical evidence

Should include?

Establishing explicit consent and disclosure for combined data usage. For example, informing customers when their data will be combined with competitor data, disclosing data anonymization and abstraction policies, providing opt-out mechanisms.

A005.1 Documentation: Consent for combined data usage

Typically demonstrated by Data Processing Agreement or Terms of Service

Typical location
Data Processing AgreementTerms of Service
Capabilities
Universal

Implementing customer data isolation controls. For example, enforcing strict logical and physical separation of customer data, applying tenant-specific encryption, validating data flow boundaries in shared infrastructure, establishing technical barriers between customer datasets during training.

A005.2 Config: Customer data isolation controls

Configuration or code demonstrating enforced isolation of each customer’s data. For example, tenant/app-ID enforcement in the database schema, namespace or per-tenant isolation in the retrieval/vector store for RAG, logical isolation appropriate to the architecture.

Typical location
Engineering Code
Capabilities
Universal
May include?

Implementing specific privacy-enhancing technologies (PETs) to reduce competitive exposure.

A005.3 Config: Privacy-enhancing controls

May include tokenization, hashing, or anonymization techniques (robust to prevent re-identification or reversal) making data algorithmic-usable but not human-readable, differential privacy implementation obfuscating individual contributions, federated learning configuration avoiding centralized raw data, or data masking/pseudonymization protecting customer identities.

Typical location
Engineering Code
Capabilities
Universal

Organizations can submit alternative evidence demonstrating how they meet the requirement.