Protecting the Crown Jewels: Customer Data

Izahir

02 Oct 2025 — 2 min read

Customer data plays a critical role within your business. When dealing with PII, everybody starts saying, no we do not want to store that... but how does your customer then do business with you? Payments, accounts, support, subscriptions, all of it depends on identity data.

And the investments you make into protecting customer data must count. Yet the reality is that many of the tools we use, with their great features and APIs, often make it harder to truly secure that same data. An export function can be useful. A retrieval API can be convenient. But how do you govern the security around these features?

This is where the real risk hides. Not in whether you encrypt your database. Not in whether you have a privacy policy. The danger is in the exit points.

Where data actually leaves

Attackers and insiders don’t need to break your storage if they can walk data out through the front door.

Stolen admin credentials used for a bulk export.
Third-party integrations with over-permissive scopes.
Support staff downloading records without oversight.
Automated backup jobs pushing to the wrong storage.
An insider intentionally copying customer files.

Which of these could happen in your business today? Which ones would you even notice?

Are your controls real, or just checkboxes?

Frameworks and guidelines like NIST or GDPR give you guardrails. They help you measure, classify, and control. But if one endpoint allows a full dataset to be exported... does any of that effort matter?

So the real question is not: do you follow a framework?

The question is: are your exports and retrievals governed as tightly as your logins?

Controls that reduce risk

The answer is not to remove exports. You need them. The answer is to govern them. This is where Zero Trust needs to extend from identity and network into data itself.

Ask yourself:

Do you require two people to approve a bulk export?
Do you allow permanent admin rights, or only temporary elevation through PIM?
Do you record the justification every time data leaves?
Are you monitoring for insider risk, not just external attacks?
Are export rights separate from read rights in your system?
Are tokens and sessions short-lived, or do they stay alive for days?
Do you redact personal identifiers by default?
Does every export require re-authentication, including device and context checks?
Are all exports logged into your SIEM?
Do you have immutable audit trails?
Are anomalies detected in real-time?

If the answer to some of these is no... then you already know where your exposure lies and you have homework.

The bigger point

You cannot run a business without customer data. But the way you control it makes the difference. Compliance and frameworks are useful. They provide structure. But if you leave a door open through a simple export, all the effort is wasted.

Exports should never be easy. They should never be invisible. Governance is what counts.

Zero Trust cannot stop at the login screen. It must follow the data until it leaves your hands.

So ask yourself: