An on-prem municipal LLM gateway vendor embeds outbound telemetry without disclosure in the contract. What supply and privacy risk is that?
Select an answer to reveal the explanation.
Short Explanation
Hidden telemetry is a quiet phone-home—resident data might leave without a hall pass. Disclose and control it.
Full Explanation
An on-prem municipal LLM gateway vendor that embeds outbound telemetry without contractual disclosure creates supply and privacy risk: prompts, metadata, or usage patterns may leave the city’s data center without a hall pass, conflicting with government privacy expectations. Assessments require disclosure, disablement or redaction options, egress monitoring, and contractual transparency before accepting the gateway for resident-facing workloads. Disclosed metering, local caching, and signed logging do not address covert egress.
Disclosed usage metering in gateway billing fails by concept: chargeback reconciliation is an administrative overhead, not a control for undisclosed telemetry. Local model cache in gateway storage creates stale-version synchronization risk, not privacy risk; it does not involve outbound telemetry leaving the data center. Signed audit logging in gateway operations creates log-retention storage overhead, but it cannot stop undisclosed phone-home channels. Distractors confuse billing, cache, and logging overhead with privacy controls.
Exam caveat: “anonymous telemetry” claims still need verification—metadata alone can identify municipal tenants or sensitive operational patterns; prefer off-by-default telemetry with city-controlled egress allow lists. Operational check: capture outbound connections from the gateway in a lab, demand a full telemetry field inventory from the vendor, disable or firewall undisclosed destinations, update the contract with disclosure and audit rights, and re-test that production egress matches the approved list only.