How do you use AI on a sensitive dataset without sending raw rows?

A spreadsheet is not a prompt. Paste it into a chatbot and the rows leave the room.

That is the usual offer: upload the file, get a fluent summary, hope the model forgets. For a member list, a records dump, or a book, hope is not a control.

The published rule on aculeus.ai is architectural, not a policy paragraph. In the Data Workbench, raw rows stay private. Starglass sees bounded schema profiles and computed aggregates. It does not see the rows, the filenames or the private object URLs. You can ask a question or run a deterministic check: counts, missingness, duplicates, a comparison. The useful finding stays in a shared Data Project. You can carry it into an editable Case Plan. Nothing auto-starts.

A fluent answer is still not proof. A check that names its inputs is.

If you run a trade association, a newsroom, or a desk, the test is simple. Can you ask the file a question without sending the file? If the answer is no, you do not have a workbench. You have a leak with a chat window.

Aculeus is the intelligence layer under Starglass, our private research workbench. The public Case example shows its source trail; it does not contain private customer rows. Judge the method and the work it produces.

Source it, or don't say it.

Source. Aculeus, Data Workbench: https://aculeus.ai/how-it-works