# Classify data and list artifacts

Lesson 1 of [Review a GPU cloud for sensitive workloads](https://gpuclouds.fyi/academy/review-a-gpu-cloud-for-sensitive-workloads.md), 15 minutes.

A review starts with the data, not with the provider. Decide what you will send before you ask what the provider does with it.

## Classify before you upload

Classify the data before you upload it. Use your own organisation's classes. Include all of these:

- Prompts.
- Training examples.
- Outputs.
- Logs.
- Checkpoints.

## Model artifacts are data

A model artifact can contain sensitive information, even if you remove the input files. Treat checkpoints and trained weights as data in your classification.

## List where each artifact lives

Make a list of every place an artifact can exist during a run: the container image, temporary disks, persistent volumes, object storage, backups, snapshots, logs and the output location. Record who can read each one.

## Ask about retention

Request the retention rules for logs and for failed jobs. A failed job can leave data behind that you did not plan for.

## Start with harmless data

Test the controls with harmless trial data before you use production data. Move to sensitive data only after the review in the next lessons is done.

## Sources

- GPUClouds guide: A GPU cloud security review

Also on the [web page](https://gpuclouds.fyi/academy/review-a-gpu-cloud-for-sensitive-workloads/classify-data-and-list-artifacts).