Permitting IT will upload city documents into a vendor fine-tuning pipeline. Which vendor security requirement is most critical?

Permitting IT uploading city documents into a vendor fine-tuning pipeline should critically verify that the fine-tuning pipeline cannot train on other customers’ data using the city’s uploads—and symmetrically cannot leak city uploads into other tenants’ models. That vendor security requirement is most critical because fine-tuning concentrates proprietary permit content; cross-tenant training or shared pools create confidentiality, integrity, and competitive exposure failures for municipal permitting.

Requiring the vendor to encrypt fine-tuning datasets at rest with AES-256 and in transit fails conceptually because encryption guards the uploads from outside interception, not from the vendor's own pipeline: once the data is decrypted to train, encryption says nothing about whether that run stays walled off from other customers' models. Requiring role-based access controls for vendor staff accessing the fine-tuning environment fails because RBAC governs which people can touch the environment, not what the pipeline does with the data once access is granted; staff can be correctly scoped by role while the pipeline still pools the city's uploads into other customers' runs. Requiring tamper-evident audit logging of fine-tuning jobs and city dataset access with retention fails because a log is a detective control recording what happened after the fact; it does not prevent the pipeline from training on the city's uploads alongside other customers' data, which is the preventive guarantee this scenario needs.

Exam caveat: contractual isolation language must match technical reality—logical tenant IDs alone may not prevent shared fine-tune corpora unless the pipeline enforces hard separation. Operational check: require written and technical evidence of per-tenant fine-tune isolation, prohibit shared training pools for city uploads, and sample vendor attestations plus configuration before any bulk permitting corpus is sent.