Multi-Brand Data Protection Design

Description

Arrivia is the product of a merger of three brands — ICE, SOR Technology, and WMPH Vacations — each of which brought its own data systems into the combined company. You've just joined as Director, Data Security & Governance, reporting to the CIO. Your first mandate: discover, classify, and protect wherever data lives across this newly combined estate — the program the team calls "DSPM + classification + DLP modernization," with encryption/key-management standardization as the next phase.

Below is the current data inventory your team has pulled together in week one. It's incomplete and messy — exactly what you'd expect right after a three-way merger.

Repository	Type / Location	What's actually in it
loyalty-member-profiles-db	Postgres on AWS RDS	Member PII (name, email, phone, address), loyalty tier, account status — shared across all three brands
redemption-transactions-log	S3 bucket	Redemption events: timestamp, partner ID, points redeemed, member ID (no name/contact fields)
payment-tokenization-vault	On-prem, HSM-backed (legacy WMPH system)	Tokenized card references + last-4 digits, used to settle redemption payments
partner-fulfillment-export	Weekly SFTP export to a third-party fulfillment vendor	CSV of member name, shipping address, redemption SKU
support-ticket-system	SaaS helpdesk (multi-brand)	Free-text customer support tickets — agents sometimes paste card numbers or account details into ticket notes
marketing-campaign-lists	SaaS CRM	Email/segment lists, opt-in status, campaign engagement history
hr-employee-records	On-prem HR system (legacy SOR Technology)	Employee PII, payroll data, SSNs
ai-support-copilot-corpus	Cloud vector store (RAG index)	Built from support-ticket text and CRM notes; feeds an internal AI assistant that drafts replies for support agents
web-session-analytics	Cloud data warehouse	Clickstream/session logs, device IDs, IP addresses, joined to member ID
legal-hold-archive	Cold storage	Historical records under an active legal hold from a past partner dispute — cannot be deleted or altered regardless of normal retention rules

Your manager needs a Data Protection & Governance Design — not code, not a slide deck of buzzwords — that a compliance officer, an engineering colleague, and the CIO could each act on.

---

Constraints to Consider

1. You cannot request new raw data fields or new repositories. Work with the inventory above — this is a constraint on classification and control design, not an invitation to ask for more data.
2. You do not own the AI model registry or runtime guardrails. That belongs to Arrivia's App & AI Security team. Your scope for the ai-support-copilot-corpus repository is training-data/RAG-source controls and prompt/response DLP only — design within that boundary.
3. You set cryptography standards; you don't rebuild Infrastructure's systems. Infrastructure owns backups and storage — you own the encryption/key-management standards they must apply. Don't propose replacing their systems.
4. The legal-hold archive cannot be deleted or reclassified out of its hold, regardless of your retention schedule. Design your retention policy to explicitly account for this exception, not around it.
5. Touch all required areas — don't go deep on one at the expense of the rest. You have 45 minutes total, including video. Breadth across the required areas, calibrated to what's achievable in that time, is what's being tested — not exhaustive depth on a single area.

---

AI Usage Guidance

We expect you to use AI tools. We evaluate how you use them — not whether you use them. Evidence of iteration, redirection, and critical evaluation scores higher than a polished output with no process documentation.

The single highest-signal indicator: your video answer to the mandatory AI question. If you cannot name a specific moment where you redirected AI output, evaluators will assume you did not.

Mandatory AI question for your video: Walk me through one moment where you disagreed with, pushed back on, or redirected what the AI gave you — and what you did instead. Name the specific moment. Explain what the AI produced that didn't meet the bar, what you did differently, and why.

Speak naturally, as if briefing your CIO directly. Communication is assessed on how clearly you translate technical controls for a broad audience — not verbal polish, accent, or filler words.

Submission: Upload each deliverable as a separate file directly on the Provn platform: your Data Protection & Governance Design, your README document (Sections A, B, and C), and your video walkthrough (MP4 or MOV).