> Palantir [...] gets access to sensitive FCA data.

Is this the right characterization? Is Palantir being given access to the data(to do with what they like), or is Palantir software being deployed in the customer private cloud environment?

I am under the impression that Palantir is typically deployed on-premise, or in a private cloud, where the customer can ensure that the data remains sovereign.

Particularly in a military setting, it would be deployed in an airgapped or highly controlled network.

> I am under the impression that Palantir is typically deployed on-premise, or in a private cloud, where the customer can ensure that the data remains sovereign.

I'll believe that when I see a thorough audit report. But anyone competent to do that wouldn't be buying Palantir in the first place.