| |
| ▲ | ryandrake a day ago | parent | next [-] | | At the company I work for, a human being gaining access to “look” at a user’s actual prod data (anything that might contain PII) is super rare and very, very difficult. And I’m not even in Europe. At least a dozen people need to approve the access, including people very senior in leadership, you need to describe exactly what data you need to see, what the business purpose is, what steps you are taking to anonymize the data (can you live with a redacted view?), exactly how long you need that access, how you are going to destroy any copies after that access is finished, and so on. This employee access, IF approved, gets logged and can be scrutinized later. And I have absolutely no doubt if you misused that access it would be noticed and you’d be fired (it has happened). I’m pretty confident that nobody at my company is going on the internet and posting “OMFG LOL our users have such crazy data u should see it LOL.” I always assumed most SeriousBusiness companies over a certain size, not run by 20 year olds, operate similarly. | | |
| ▲ | csallen a day ago | parent | next [-] | | If that's all true then it's almost certainly because you work at a large, mature, bureaucratic, unusually privacy-focused company. Verrrrry few companies work like this when they're small and new. I'd round down to ~0%. And I would bet that, if your company was ever a small startup, it didn't work like this back then, either. Also, this idea that it's bad or weird to anonymously discuss customers is strange. I've known cops, doctors, dentists, and all sorts of other people who routinely share stories about weird things that happen with people and customers at work, anonymously. This is the norm in the world and always has been. It's also the norm for the companies who own your data to look at it, when asked to. What do you think customer support even is? It's only really a small corner of the tech world that treats these things as strange and sacrilege. | |
| ▲ | m4rtink a day ago | parent | prev | next [-] | | Yeah, that is the correct behavior what I would expect in a business setting - its a basic decency, not to mention customers switching to competition if they find out their data is not protected. | |
| ▲ | weird-eye-issue a day ago | parent | prev | next [-] | | > anything that might contain PII Sounds like your software might require HIPAA compliance in which case everything that you just said makes sense and is likely required in that context. But for the average SaaS that doesn't need HIPAA compliance it doesn't work like that. | |
| ▲ | rcxdude a day ago | parent | prev [-] | | What do you do when you're providing tech support to a customer about an issue that is related to their data? Obviously there should be some process in place but a customer going 'hey could you look at this' is a perfectly valid reason to, you know, look at it. And it's not particularly unusual to discuss vague details of your customers anonymously. Even in the medical field, with very strict privacy rules, doctors will often publicly discuss encounters they have had with patients, and they only cross the line when they identify the patient. | | |
| ▲ | ryandrake a day ago | parent [-] | | That’s a good question, I honestly have no idea how customer support works. My guess is they have access to heavily audited systems that automate away these approvals, are limited to tools that can delete/reset but can’t read, and/or are given a filtered/redacted window to the user data they do actually need to see with human eyes. |
|
| |
| ▲ | m4rtink a day ago | parent | prev [-] | | Sure, which is why I think if one wants to run any agents with sensitive data, they need to be fully self hosted so that operators can't look into your data. Anything else is insane and will be used against you. | | |
| ▲ | weird-eye-issue a day ago | parent | next [-] | | > will be used against you I mean I'm all for privacy and security but this statement right here just comes across as pretty paranoid | | |
| ▲ | threecheese a day ago | parent [-] | | - A woman using Claude for her diary just had her information used against her.
- A nytimes civil suit against OpenAI just had user data handed over to lawyers.
- US federal agencies are buying ad marketplace data and joining it with other commercial and government data to extra-judicially identify persons We are giving an unprecedented amount of personal data to these tools at the same time that the technology is being leveraged against people at an unprecedented scope and scale. No US legal framework exists to protect you against this. You should take this risk seriously. |
| |
| ▲ | lmf4lol a day ago | parent | prev [-] | | Do you feel the same way about emails, cloud drives or SaaS like Salesforce or Jira? |
|
|
