How do you use AI on a sensitive dataset without sending raw rows?

A spreadsheet is not a prompt. Paste it into a chatbot and the rows leave the room.

That is the usual offer: upload the file, get a fluent summary, hope the model forgets. For a member list, a records dump, or a book, hope is not a control.

The published rule on aculeus.ai is architectural, not a policy paragraph. In the Data Workbench, raw rows stay private. Starglass sees bounded schema profiles and computed aggregates — not the rows, not the filenames, not the private object URLs. You can ask a question or run a deterministic check: counts, missingness, duplicates, a comparison. The useful finding stays in a shared Data Project. You can carry it into an editable Case Plan. Nothing auto-starts.

A fluent answer is still not proof. A check that names its inputs is.

If you run a trade association, a newsroom, or a desk, the test is simple. Can you ask the file a question without sending the file? If the answer is no, you do not have a workbench. You have a leak with a chat window.

Aculeus is the intelligence layer under Starglass. We do not publish a public case file yet. Judge the method.

Source it, or don't say it.

Source. Aculeus, Data Workbench — https://aculeus.ai/how-it-works