PLT-011 · formerly GOV-012

Inspect uploaded content without permanent file retention

Acceptance criteria

Webhook, pointer or in-place inspection so source files stay in enterprise-controlled storage.

Copying every uploaded file into another vendor's storage creates a second copy to protect.

The vendor documents and shows how uploads are inspected without permanent retention.

Upload inspection across the listed employee AI contexts should avoid unnecessary permanent copies, regardless of which tool receives the content.

NIST CSF 2.0 PR.DS-10
In-place or pointer-based inspection can examine data in use while limiting copied personal data and unnecessary retention by the inspection service. Buffers, logs, derived content and subprocessors still need checking; reduced copying does not prove zero retention or an operated leakage-prevention workflow.
SOC 2 P4.2
Avoiding permanent copies can support personal-data retention limits when the Privacy category and relevant inspection service are in scope. Verify buffers, logs, derived content and subprocessors; enterprise source-file retention remains separate. Non-retention does not demonstrate that less personal information was collected or read.
ISO 27001 A.5.34
Keeping inspected files in enterprise-controlled storage can limit unnecessary PII copies. The privacy link depends on personal data being present and actual copying limits, including caches, previews, derived content and subprocessors. Non-retention does not demonstrate deletion or an operated leakage-prevention workflow.