An over-restricted environment pushes analysts to find another route to the data.

Making sensitive data completely unreachable is not a solution but a surrender. This page is about isolating data while keeping it analyzable: who can see it, in which environment, in which form.

Layers, catalog and quality belong to the Data Lake page under Services. Here we discuss isolation and egress control.

Set the isolation level Back to Data Sovereignty

The isolated analysis environment

Sensitive data can be analyzed without landing on a user's own machine. The data stays in the environment and the user comes to it; results pass a control on the way out.

Data is never copied to the user's device
Access to the environment is logged
Analysis tooling is provided inside the environment
Internet access within the environment is controlled

Masking and minimization

Most analysis does not require real identity data. Masking, pseudonymization and aggregation make data sufficient for analysis and insufficient for identification, lowering risk at the source.

Masking applies at query time rather than through a copy
Why a field is needed must be stated in writing
Aggregation thresholds protect small groups
Re-identification risk is assessed separately

Egress control

The point of isolation is that results leave under control. Everything taken out of the environment passes an approval; raw data export is blocked as a rule and only aggregated results leave.

Raw data export is blocked by default
Exported results are recorded and reviewable
Screenshot and print policy is defined
High-volume export requires additional approval

Keeping it usable

An over-restricted environment goes unused and analysts look for other routes to the data. Performance, tool support and access lead time are therefore part of the design.

Access requests resolve in hours rather than days
The tools analysts already know are available
Performance is measured; a slow environment gets abandoned
Usage data feeds the review of restrictions

How we work

Identify sensitive datasets and their purpose
Build the isolated environment and its access path
Apply masking and minimization rules
Define egress control
Measure usage and revisit the restrictions

How success is measured

Sensitive data never lands on a user device
Nothing leaves the environment without a record
Access requests resolve within the target time
Analysts use the environment rather than route around it

Frequently asked questions

Can AI work be done inside this environment?

It can, and often it should. Where model training approaches sensitive data it needs to stay inside; what leaves is the model or an aggregated result.

What is left to the Data Lake page?

The lake's architecture belongs there: layers, catalog, quality and cost. This one covers isolation, masking and egress control for sensitive data.

What if analysts find it slow?

They abandon the environment and look for another route to the data. Performance is therefore a security requirement rather than a comfort, and it is measured and improved.

Let's establish who analyzes which data and for what purpose, then set the isolation level together.

Set the isolation level