Compliance and best practices
How synthetic data fits privacy regulations, what your team is responsible for, and how to report a security issue.
Using fully synthetic data in test and development environments removes real personal data from places where it is hardest to control. That reduces what your privacy and security programmes need to cover there.
This page is general guidance, not legal advice. Confirm your obligations with your own legal or compliance team.
How synthetic data fits common regulations
| Regulation | What it protects | How fully synthetic test data helps |
|---|---|---|
| GDPR (EU) | Personal data of people in the EU | Data that doesn’t relate to an identifiable person isn’t personal data, so test environments with no real records fall outside most GDPR duties. It also supports data minimisation. |
| HIPAA (US) | Protected health information (PHI) | Fictional patients, appointments and notes contain no PHI. Teams can build and test healthcare systems without accessing real patient records. |
| DPDP Act 2023 (India) | Digital personal data of individuals in India | Fictional records describe no real data principal, which reduces consent and handling obligations for test and demo data. |
These benefits depend on the data staying synthetic. If real values enter through sample values, imported files or chat attachments, those values are personal data again. See Where real data can slip in.
Shared responsibility
| TeraGen AI is responsible for | Your team is responsible for |
|---|---|
| Generating values that are fictional by design | Using made-up sample values and fake example rows |
| Keeping generated rows in your browser | Where you store and share downloaded files |
| Signing in every request and protecting passwords with salted hashes | Strong, unique passwords and signing out on shared devices |
| Keeping AI service keys on the server, and rate-limiting AI use | Not uploading files that contain real or confidential data |
| Producing scripts you can read before running | Reviewing scripts, especially Other database ones, and running them only against test databases |
Checklist for your team
- Agree that production data is never used in test, staging or demo environments.
- Use invented sample values that only copy the format of real ones.
- Import schemas, not data: strip real rows from SQL or CSV files before uploading.
- Keep AI Chat attachments free of personal or confidential information.
- Keep chats Private unless you mean to share them.
- Review
create_tables.sqland load scripts before running them. - Load generated data into test databases only, never production.
- Label synthetic datasets clearly so no one mistakes them for real data.
Report a security issue
If you find a vulnerability or suspect your account has been misused, email contact@teragenai.com with Security in the subject. Include what you found, the steps to reproduce it, and the page or feature affected. Please don’t share details publicly until we’ve had a chance to fix the issue.