What AI remembered about a customer: Vault export, subject request and other people's vectors

Google taught Vault to export employees' conversations with Gemini, CustomerThink reminded everyone that a “hand over everything you store about me” request lands in the shared inbox without warning, a Directum methodologist went through what an HR person may give to a model, and Weaviate closed a hole that let someone reconstruct someone else's vector. Four stories about one thing: everything a model has read about a customer or an employee is stored somewhere, and one day someone will ask to see it or delete it. A business owner should know where exactly.

What came out

Google Workspace reported on October 22 that Google Vault supports filtered exports of Gemini in Workspace conversations. An administrator picks users or organizational units, up to 5,000 accounts, sets a period and gets JSON: the user's prompts, the model's responses, the attachments it created and links to the Drive files and Gmail messages the model accessed. Retention rules and legal holds for this data Google promises in upcoming releases, while the admin console already lets you block users from deleting history by hand or turn on automatic deletion after a period of inactivity. The API will arrive within 14 days of the interface.

CustomerThink on October 20 started with a simple experiment: a data subject request arrives on a Tuesday afternoon in the support team's shared inbox, asking for all personal data. Who handles it, legal or IT, whether to answer it yourselves, and how many days you have. I only have the article's announcement, so I'm retelling the question, not the author's conclusions.

On Habr on October 15, Ruslan Nuriev, a methodologist and analyst at Directum, wrote about the same thing from the HR side: HR wants to use models for schedules, document review and answers to unusual requests, but much of the data an HR person holds is personal, and fines for violations, he says, grew several times over in 2025. From this article I also have only the introduction.

Weaviate on October 15 released version 1.39.3 with a fix for a medium-severity vulnerability in the nearObject operator. The search took an object's vector from one collection and looked for similar ones in another, but checked permissions only on the collection it searched in. The object itself didn't make it into the response, but the distances to it did, and from the distances the vector can be reconstructed: a researcher recovered a normalized four-dimensional vector to within 5e-9 from eight probe objects. The attack needs the collection name and the object's UUID, permission to read collection definitions and permission to create data in some collection of your own. Weaviate has seen no signs of exploitation. This concerns those who share one cluster between teams through RBAC.

Example: a car rental and “what do you store about me”

Take a car rental. For one customer the company has a booking, a scan of the driver's license, photos of the car at handover, a screenshot of the payment and a signed contract. Now add an assistant on a model that answers managers' question “what's going on with this customer,” and a vector database where the contracts and correspondence were put for search. A request comes in: hand over everything. Exporting the booking and the documents is easy. The history of managers' questions to the model about this person, and his data inside the search index, someone will have to remember and find.

Each new tool with a model adds one more place where data about people lives. If that place isn't on the list, a data subject request turns into an investigation.

How it works for me

The densest stream of other people's personal data in my work goes through the parsers for a PDR company in the US. Since 2023 they've been reading insurance estimates, reports and photos with VINs; insurance documents run up to 60 to 70 pages. In 2026 I connected AI validators and shipped the release version: around 99.9% of documents go through without manual correction, and a person does the final check. For validation I use three different services, Anthropic, OpenAI and Gemini, each for its own task. How the validation works inside, I don't disclose.

Where the data goes after parsing, I know for each document: the company's super app, the CRM, estimates, partly the leaderboard and the TV screens. Any “show me” or “delete” request starts from that map. A separate deletion scenario for a data subject request I haven't tested on my side. If such a request comes, I'll start from the map instead of searching the server.

What I would do

Make a list of the places where data about people lives, including conversation history with models and vector indexes. For Workspace there's now the Vault export; for your own systems you'll have to keep the list yourself.

Decide in advance what goes to an external model service and what stays on the server. To check an estimate, the validator needs line items and amounts; the car owner's name and address are of no use to it. These things are decided before sending.

Turn on the same retention rules for model history as for email: a period, auto-deletion, a ban on manual deletion if the business requires it.

Check the permissions in the vector database, as Weaviate advises: who can read collection definitions and who can create data anywhere at all. If you run Weaviate, update to 1.39.3.

Assign one person who receives data subject requests from the shared inbox and knows whom to pass them to.

Related reading

Where a model helps parse documents and how to check the result, I covered in the article AI in data processing: extraction and verification, and the approach is described in AI in a process where the result can be verified. The parsers themselves: a PDR company in the US saves about 60 hours a week. Nearby are my reviews on the Decisions API and agent memory and on extracting data from documents in 2026, and earlier I wrote on masking data in messages and logs and on the memory of a customer that AI has already built up. If your models already read customer documents and you're not sure where it all lives, tell me which documents and which systems. Discuss your task.