What does encryption solve, and what remains?
Encryption protects data under its key and access assumptions. It does not remove identifying information from a dataset available to an authorised user. Keep encryption, field transformation and access control as separate requirements. Ask where keys are held, whether exports and backups are covered, and whether diagnostic logs contain sensitive values. Test the actual configured workflow rather than accepting a generic encryption badge.
Which operational checks matter for a PoC?
Use a source account with the permissions the proposed workflow actually requires. Restrict target and project access, define retention and check cleanup after success and failure. Try one interrupted run and one revoked credential. Verify which execution details are recorded without exposing raw sensitive values. Include operator time, upgrades and recovery in the total cost of the shortlisted tool.
How should you assess software supply-chain dependencies?
Inventory the runtime, plugins, model packages and connectors used by the scenario. Record versions and provenance, review maintenance and update mechanisms, and test an upgrade with fixed acceptance data. An export may still depend on a proprietary connector or hosted service. Ask for an exit demonstration with the exported project and its real dependencies, rather than treating data download as proof of portability.
What must leave the source environment?
Map each step: source read, temporary files, transformed records, logs, backup and final export. Give each location an owner and retention period. Check whether production values can appear before transformation or in diagnostics. Test the complete path with a non-sensitive marker and verify cleanup after interruption.
How do you test a realistic exit?
Export one representative scenario and inventory the files, secrets references, external models and connector versions it needs. Restore it in a separate environment and run the same acceptance checks. A downloadable dataset demonstrates data access; it does not by itself show that the generation and transformation rules run elsewhere.
References and further reading
Choose your next step
- Test Data Platforms: Criteria and Tools Compared
- Define requirements and a proof of concept
- Test data generation: a practical first scenario
- Anonymize test data without breaking the test
- Synthetic test data: rules, learned patterns and hybrid workflows
- Replacing Informatica or CA TDM: migration checklist
- Test data without production data: choices and privacy
- Kafka test data: events, ordering and acceptance
- Open source or enterprise test data tools?