Vector Databases Are Leaking Data Your DLP Cannot See
Embeddings are not anonymised. They are reversible enough to matter, they usually sit outside your classification tooling, and in most deployments every user can retrieve every chunk.
When a company copies its knowledge base into a vector store, it typically creates a second copy of its most sensitive text — stripped of the permissions model that protected the first copy. Two years into the RAG boom, that second copy is where our assessments find the highest-severity data exposure.
Three uncomfortable properties of embeddings
They are not anonymisation
Inversion research has been steadily improving. For short text — names, addresses, medical codes, credentials — recovering a close approximation of the original string from an embedding is practical, not theoretical. Treat an embedding as ciphertext with a weak key, not as a hash.
They inherit no permissions
The source document was restricted to a group of twelve. The chunk in the index is retrievable by any query that lands near it. Unless the retriever filters on a per-user ACL at query time, the restriction is gone.
They are invisible to classification tooling
DLP, CASB and data-catalog products scan files and database columns. A float array in a managed vector service is none of those things, so the sensitive-data inventory silently understates reality.
The control set
- Per-user ACL filtering at query time. Store the source object's permission identifiers as metadata and apply them as a hard pre-filter. Post-filtering the results is a leak, because the model already saw them.
- Separate indexes per trust boundary. One index per sensitivity tier is coarse but robust; a single index with clever filtering fails as soon as one filter is wrong.
- Redaction before embedding. Strip secrets, PII and payment data on ingestion. What is not embedded cannot be retrieved or inverted.
- Encryption and key ownership. Managed vector services should hold data under a key you control, with the same retention and deletion guarantees as the source system.
- Deletion that propagates. When a source document is deleted or a user's data is erased, the chunks must go too. Most pipelines we review have no deletion path at all.
The audit question
Pick a restricted document. Ask an unprivileged account a question that only that document answers. If the assistant answers correctly, your access control ends at the file share and your data does not.
The vector store is a production database holding your most sensitive text. Govern it like one.
