(US & Canada) Sid Dutta, CEO and Founder of Privaclave, speaks with Robert Lutton, VP, Sales and Marketing at Sandhill Consultants, in a video interview about how Privaclave addresses data security challenges and is different from other existing solutions, and the approach to LLM and GenAI-related roadblocks.

Privaclave is a data-centric security solution. When asked how the organization addresses specific security challenges, Dutta states that Privaclave was born to address the pain points that enterprises face in implementing data security. Pivoting to the phrase “data protection by design and by default,” he adds that it is a sound philosophy but lacks practicality when it comes to dealing with legacy applications and surveys.

Highlighting the challenges, Dutta states that since the existing applications were not designed according to the principle, it becomes more of a data protection through redesign. Further, the redesigning of applications becomes expensive, invasive, and time-consuming, thereby becoming a pain point for enterprises.

The enterprises that find it challenging to implement such measures and thus rely on compliance-driven controls, says Dutta. He adds that while data protection can be incorporated into new applications from the design stage, these applications rarely operate in isolation.

As the applications exist within an ecosystem of interconnected applications, there cannot be one application that is designed with data protection but the other is not, as it creates a challenge.

Privaclave aims to address one of the foundational challenges that arise with the varied interpretations and implementations of data protection by design and by default, says Dutta. Speaking from experience, he states that another recurring issue has been the gap between data discovery and identifying risks.

According to Dutta, when it comes to risk remediation, there is a lack of a continuum from risk identification to remediation. He maintains that as organizations identify risk, scan and discover classified data, and understand lineage and access, it ultimately leads to a point of massive findings that demand quick prioritization.

Therefore, Privaclave also tries to address this gap that requires a continuous bridge to be built. Circling back, Dutta states that some of the biggest challenges that the organization is solving include implementing data-centric protection and effectiveness of application-level encryption and tokenization entirely noninvasively, automatically, and transparently without altering applications or disrupting data flows.

In addition, Privaclave enables continuous risk monitoring and tracking data as it moves through APIs, file transfers, and third-party integrations.

Moving forward, Dutta states that while there are numerous other good solutions on the market, what separates Privaclave from the rest is that it is not invasive. Also, it is entirely decoupled from the application stack and avoids operational hassles and costs to upgrade the solution.

Moreover, the application platform’s language runtime is entirely agnostic, meaning there are no dependencies on specific programming languages, platforms, clouds, SDKs, agents, or libraries that need to be integrated. It provides real-time, runtime-sensitive data detection across any data pipeline or inter-service communication rather than a point-in-time targeted data discovery, says Dutta. Most importantly, it enables enterprises to elevate and progress from detecting sensitive data to protecting it.

When asked how Privaclave integrates with existing systems, Dutta mentions extensively leveraging the API layer and various data pipelines to operate independently and automatically. He adds that Privaclave deeply integrates with identity and access management systems, or IDPs, specifically to control data access, particularly with decryption or detokenization.

Every operation is thoroughly logged, says Dutta, and it is great for enterprise-seeking platforms to have a solid view of network activity. This essentially helps in triggering alerts to potential data exfiltration.

Thereafter, Dutta maintains that for enterprises that have existing investments in key management, tokenization, or encryption engines, Privaclave offers seamless third-party integration capabilities to protect the data.

The approach ensures that enterprise applications remain untouched while the data is being desensitized. Dutta states that Privaclave is designed to be both ubiquitous and ephemeral. The infrastructure spins up when needed, performs its tasks, and then spins off, allowing data and applications to flow uninterrupted while maintaining persistent protection.

Highlighting how Privaclave addresses LLM and GenAI challenges, Dutta states that it is extremely focused on the privacy and security principles of a responsible AI framework. To uphold that principle, the focus is directed toward vulnerabilities and risks, particularly with sensitive information disclosure, training data poisoning, and insecure output handling.

Dutta reiterates that Privaclave offers enterprises this transparent, non-invasive solution for integrating effective data sanitization and scrubbing techniques. This ensures that sensitive data does not enter the training model even during model enrichment or fine-tuning processes.

In conclusion, Dutta states that the system identifies and sanitizes sensitive information at runtime during both the pre-training and embedding phases, while also monitoring and comprehending the inputs sent and the outputs retrieved from LLMs. Essentially, Privaclave leverages the power of AI and LLMs to secure data exchanges with LLMs.

CDO Magazine appreciates Sid Dutta for sharing his insights with our global community.