DEV Community: Ijaz

Your RAG Pipeline Is Leaking Customer Data Into Vector Embeddings

Ijaz — Fri, 24 Apr 2026 09:23:42 +0000

"If you embed a chunk that says ""Sarah Mitchell called about her order to 14 Beechwood Avenue, Manchester,"" the embedding captures the semantics of that entire passage. The vector database now contains a representation derived from a customer's personal data. And more importantly, the text chunks stored as metadata contain the original PII in plain text.

Three specific risks:

Cross-user data leakage: Agent A queries the system, retriever pulls chunks from Agent B's tickets containing Agent B's customers' details.
Right to erasure: Customer exercises GDPR Article 17. Their data is fragmented across thousands of embeddings. Identifying and removing specific embeddings that encode their PII is extremely difficult.
Vendor exposure: If your vector DB is hosted (Pinecone, Weaviate Cloud), PII is in another third party's infrastructure.

The fix: sanitise before embedding. Strip PII from chunks before generating embeddings. The semantic meaning is preserved. Retrieval still works on ""customer called about delivery issue."" The personal identifiers are gone.

curl -X POST https://api.comply-tech.co.uk/api/v1/anonymise \
-H ""X-Api-Key: demo-key-complytech"" \
-H ""Content-Type: application/json"" \
-d '{""content"":""Customer Sarah Mitchell (sarah@gmail.com) called about delayed delivery to 14 Beechwood Ave, Manchester"",""contentType"":""text"",""strategy"":""Redact"",""frameworks"":[""GDPR""]}'

We tested this. Retrieval quality is unaffected because semantic search matches on the problem described, not the customer's name."

How to Build an Internal AI Tool Without Your Compliance Team Blocking It

Ijaz — Sun, 05 Apr 2026 15:02:12 +0000

Three AI feature projects at three companies, all blocked by compliance. Here's the architectural pattern that gets AI tools approved, plus a practical checklist for making it happen.

Read the full article here: https://comply-tech.co.uk/blog/internal-ai-tool-compliance

The EU AI Act Starts Enforcement in August 2026. Here's What That Means for Your LLM Pipeline.

Ijaz — Wed, 01 Apr 2026 15:32:36 +0000

The EU AI Act enforcement starts in August 2026. Here's what the provisions actually mean for engineering teams building with LLM APIs, and what you can do about it with a simple pipeline change.

Blog article

One API call to make any data GDPR/HIPAA/CCPA compliant. From zero to compliant in 10 minutes, not 10 months.

Ijaz — Wed, 04 Mar 2026 15:37:07 +0000

Over the past few years, I kept seeing the same pattern inside growing tech teams. A GDPR deletion request comes in or an enterprise customer asks for proof of erasure or legal wants confirmation that data is gone everywhere and suddenly it’s not simple anymore.

Someone writes a script.
Another team checks a different service.
Analytics gets queried manually.
Logs and backups become “we’ll deal with that later.”
Technically compliant? Probably. Operationally clean? Not really.

That friction is what inspired me to start building ComplyTech. Most compliance tools focus on dashboards and policy tracking. But the hardest part isn’t policy — it’s execution. In modern systems, PII lives across microservices, warehouses, third-party tools, logs; deleting a user isn’t a database command anymore. It’s orchestration. So instead of building another compliance dashboard, I’m building an API layer that lets engineering teams programmatically coordinate PII deletion and generate audit proof without stitching together custom scripts every time.

The biggest shift for me during this process was realising this isn’t a UI problem. It’s infrastructure. Still early days, but the conversations with CTOs and platform engineers have been eye-opening. The real pain isn’t regulation — it’s complexity and fragmentation. If you’re running distributed systems and have thoughts on how your team handles deletion or audit proof today, I’d genuinely love to hear about it.

Or take a look at my site and check out the demo, if this interests you, you know what to do! - https://comply-tech.co.uk