What does encryption solve, and what remains?
Encryption protects data under its key and access assumptions. It does not remove identifying information from a dataset available to an authorised user. Keep encryption, field transformation and access control as separate requirements. Ask where keys are held, whether exports and backups are covered, and whether diagnostic logs contain sensitive values. Test the actual configured workflow rather than accepting a generic encryption badge.
Which operational checks matter for a PoC?
Use a source account with the permissions the proposed workflow actually requires. Restrict target and project access, define retention and check cleanup after success and failure. Try one interrupted run and one revoked credential. Verify which execution details are recorded without exposing raw sensitive values. Include operator time, upgrades and recovery in the total cost of the shortlisted tool.
How should you assess software supply-chain dependencies?
Inventory the runtime, plugins, model packages and connectors used by the scenario. Record versions and provenance, review maintenance and update mechanisms, and test an upgrade with fixed acceptance data. An export may still depend on a proprietary connector or hosted service. Ask for an exit demonstration with the exported project and its real dependencies, rather than treating data download as proof of portability.
Illustrative scenarios and editorial acceptance criteria; not measured product benchmarks.