Housing-intake extracts contain Social Security numbers destined for an agent-facing store. What privacy-preserving ETL step should run first?
Select an answer to reveal the explanation.
Short Explanation
Keep SSNs out of your agent-facing stores from the start. Tokenize or redact PII during ETL, before the data is loaded—privacy first, retrieval second.
Full Explanation
Housing-intake extracts containing Social Security numbers should be protected before they enter an agent-facing store. Tokenizing or otherwise redacting PII fields during ETL limits exposure at ingestion, before an agent can retrieve the records; relying on prompts to keep SSNs out of answers to residents or clerks is not a substitute. Copying raw SSNs into every vector collection for easier lookups increases the number of places where sensitive data can be exposed and maximizes the blast radius of a breach. Posting full applicant files to a public Slack channel for peer review is a severe confidentiality failure because it discloses the records in an uncontrolled setting. Keeping SSNs intact during loading and tokenizing them only after agents have accessed records leaves a preventable exposure window and acts too late. Exam caveat: tokenization must preserve joinability when a business process requires it; use a controlled vault or format-preserving tokens rather than irreversibly destroying keys needed for legitimate operations. Practical check: scan agent-facing stores after ETL and sample retrievals for SSN-shaped values; fail the pipeline if raw PII appears downstream of the redaction stage.