Storage and backups
Retention, lifecycle, deletion, and restore drills for AI data across managed and unlisted stores.
Run covers provisioning stores. Control sets retention, access, deletion, and recovery requirements for the data in them.
Set retention periods
Without a retention period, AI data remains indefinitely. Conversation history, prompt logs, and traces can all contain copies of user-provided data.
Set a period per store based on its contents:
- Keep conversation history long enough to support disputes and support work while limiting unnecessary exposure.
- Treat prompt and completion logs as if they contain personal data and credentials. Keep them longer only when an obligation requires it.
- Sample routine traces and retain abnormal ones. See traces.
- Define deletion behaviour for vector indexes because they have no natural expiry.
- Include generated artifacts in retention and access policies.
Enforce each retention period and verify that the lifecycle policy ran. Documentation alone does not show that data was removed.
Propagate deletions
When a person exercises a deletion right, or a document is withdrawn, it has to leave the primary store, the object storage, the index, the conversation history, the prompt log, the trace store, and any backup retained long enough to matter.
Document the propagation path as a list of systems and deletion mechanisms. This review identifies copies that have no deletion mechanism before a formal request arrives.
Restore drills
Backup jobs do not show that a restore will produce a working system. Run restore drills against the complete application.
Include the primary database and vector index in the drill, along with their restore order. If the recovery plan rebuilds the index, measure the rebuild time and embedding cost.
Assign an owner and schedule the drill. Record its duration, then compare the measured result with the documented recovery time objective.
One storage URL, 38TB, and a token that expired in 2051
Microsoft's AI research team published open-source image-recognition training data on GitHub (the robust-models-transfer repo) via an Azure Storage URL carrying a Shared Access Signature token. The token was scoped to the entire storage account with full-control permissions, exposing 38TB of internal data alongside the intended models. Wiz Research found it on June 22, 2023; Microsoft invalidated the token on June 24 and both parties published on September 18, 2023.
The skipped letter. Secure was the missing letter. The over-scoped, full-control, 28-year token was a configuration error, a control failure, but the reason one researcher's mistake stood for three years is that nothing governed SAS issuance: no inventory, no monitoring, no expiry policy, no revocation path short of rotating the account key. Wiz's own conclusion was a governance one, that account SAS tokens are ungovernable by design and organizations must treat them like the account key itself. Run is the wrong primary; secrets were among the spoils, not the mechanism, and the runtime never misbehaved. Control earns second position for the token's scope and permissions themselves.
38TB of data accidentally exposed by Microsoft AI researchers (Wiz Research) / Microsoft mitigated exposure of internal information in a storage account due to overly-permissive SAS token (MSRC) / Microsoft AI researchers accidentally exposed terabytes of internal sensitive data (TechCrunch, Carly Page)
Protect telemetry access
A trace store may have broad read access because the platform team built it for debugging, even when it contains sensitive material.
Apply the same standard you apply to the source data. If only four people can read the claims table, then only four people should be able to read traces containing claims data.
Questions to ask your vendor, or your own team
- What is the retention period for conversation history, and what enforces it?
- List every store that holds a copy of a customer document. Which have a deletion path?
- When did you last restore an AI application from backup, end to end, as a drill?
- How long does a full vector index rebuild take, and what does it cost?
- Who can read the trace store today? Compare that to who can read the source data.
- Is there a bucket of generated artifacts with public or broad access?