Yes, scan training, fine-tuning, and evaluation data for secrets and personal data before use. Anything in a dataset can end up in a model, a prompt log, or a test report. Scanning is cheap compared with retraining, and it gives you a record to show customers who ask how data is handled.
Why datasets are a risk surface
OWASP lists sensitive information disclosure as LLM02:2025 and data and model poisoning as LLM04:2025. Both start with the data. Keys pasted into support tickets, personal details in chat logs, and customer files used as eval cases all travel into places they were never meant to go: fine-tuned weights, shared notebooks, vendor platforms.
What to look for
| Finding | Why it matters | Typical action |
|---|---|---|
| API keys, tokens, passwords | Can be repeated by a model or exposed in logs | Remove and rotate the key |
| Personal data | Privacy law and contract duties | Remove, mask, or confirm lawful basis |
| Customer confidential content | Contract limits on use | Exclude unless the contract allows |
| Duplicated or odd records | Possible poisoning or quality issue | Review and quarantine |
| Licensed or restricted content | Usage terms | Check before inclusion |
A workable process
- Inventory datasets. Record source, owner, and purpose for each one.
- Scan on ingestion. Run secrets detection and a personal data pattern check before data lands in the training bucket.
- Rotate, do not just delete. A key found in data should be treated as exposed. Revoke it.
- Keep customer data out of shared evals unless the contract and your retention terms allow it. Prefer synthetic or masked cases.
- Version datasets so you can show which data a given model saw.
- Re-scan when data is refreshed.
Be careful with eval reports
Eval outputs often contain raw prompts and answers. Treat the report as data with the same sensitivity as the inputs, and restrict who can open it.
Tie it to your commitments
If your policy says you do not train on customer data, the scan and the dataset inventory are your evidence. Answers in security questionnaires should match what the pipeline actually enforces.
A short note on Safeguard
Safeguard offers secrets detection and compliance and evidence automation, which can hold the records described above. Try a free scan at gold.safeguard.sh/scan.
Quick check
Is deleting a leaked key from the dataset enough?
No. Assume it was copied. Revoke and replace it.
Can we use customer data for evals?
Only if your contract allows it. Masked or synthetic data avoids the question.
Sources
Last reviewed: 19 October 2026.
