Can this data leave
Decide whether a clinic client's support emails may reach the model provider this month, price the wait against the contract, and set what must be true first.
On this page
The agency's own support triage, not the retailer's desk from this module's lessons, is ready to take on the last client it does not yet serve, and that client's contract says where its data may go. The data map from least-privilege credentials and data leaving the tenant is where the answer starts.
The situation
The agency's support triage reads the shared support inbox for its 40 client projects, about 30 emails a day, and so far handles every client except the largest: a chain of 12 clinics on a $9,000-a-month retainer, whose staff send about 8 of the 30. An account manager handles those 8 by hand at about 10 minutes each. The clinic's contract lists the sub-processors allowed to handle its data; the model provider is not on the list. Adding one needs 30 days' written notice, and the clinic may object in that time.
About one clinic email in ten includes patient details pasted in by staff — a failed online booking, with the patient's name and appointment time. The rest describe website problems. Assume the provider's terms keep inputs for 30 days for abuse monitoring and do not use them for training, and staff time at $30 an hour. The founder wants the clinic's emails switched on this week, "with the names stripped out".
The question
Decide whether the clinic's emails can go to the model provider this month, and what has to be true before they do.
A strong answer · Rubric · Where answers go wrong
Write your answer first, then open