{"id":"PLT-011","section":"Platform, Privacy & Assurance","requirement":"Inspect uploaded content without permanent file retention","acceptance":"Webhook, pointer or in-place inspection so source files stay in enterprise-controlled storage.","tier":"AT0–AT4","whyItMatters":"Copying every uploaded file into another vendor's storage creates a second copy to protect.","verificationMethod":"D + W","verificationTest":"The vendor documents and shows how uploads are inspected without permanent retention.","formerly":"GOV-012","alsoIn":[],"sort":65,"adoptionContext":"Upload inspection across the listed employee AI contexts should avoid unnecessary permanent copies, regardless of which tool receives the content.","mappings":[{"frameworks":["csf"],"explanation":"In-place or pointer-based inspection can examine data in use while limiting copied personal data and unnecessary retention by the inspection service. Buffers, logs, derived content and subprocessors still need checking; reduced copying does not prove zero retention or an operated leakage-prevention workflow.","kind":"framework","references":{"csf":["PR.DS-10"]},"relation":null,"conditions":[]},{"frameworks":["soc2"],"explanation":"Avoiding permanent copies can support personal-data retention limits when the Privacy category and relevant inspection service are in scope. Verify buffers, logs, derived content and subprocessors; enterprise source-file retention remains separate. Non-retention does not demonstrate that less personal information was collected or read.","kind":"framework","references":{"soc2":["P4.2"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Keeping inspected files in enterprise-controlled storage can limit unnecessary PII copies. The privacy link depends on personal data being present and actual copying limits, including caches, previews, derived content and subprocessors. Non-retention does not demonstrate deletion or an operated leakage-prevention workflow.","kind":"framework","references":{"iso27001":["A.5.34"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-011","frameworkRefs":{"ISO27001":["A.5.34"],"NIST-CSF":["PR.DS-10"],"SOC2":["P4.2"]}}