“We can't send our logs to a vendor”
CISO · Observability
A CISO whose logs are full of personal data is right to be careful about sending them anywhere: a log pipeline can quietly become a data breach. Don't argue that the risk is small. Ask what's in the logs: which data must never leave, and show how it can be filtered out before anything is sent.
Practise it before the real call
Free to start. No credit card.
What the buyer says
Our logs are full of personal data. Sending them to another vendor is a risk I won't take.
How to handle it
Listen
Hear "full of personal data". The concern is specific: personal data leaving their control, and the compliance risk that follows.
Acknowledge
Agree that logs often contain personal data they didn't intend to keep, and that sending them to a third party needs care.
Explore
Ask what kinds of personal data appear in their logs, which data must never leave their environment, and what their data protection team would need to see. Ask where the data would need to be stored.
Respond
Show specifically how data can be filtered or masked before it leaves their environment, where it would be stored and who could access it. Offer to answer the data protection team's questions directly.
Say this
“That's the right concern. Logs often carry personal data nobody meant to keep.”
Say this
“Which data must never leave your environment?”
Say this
“What would your data protection team need to see?”
Variations
- Data Protection Officer: “Our logs contain patient data. That can't go to a third party.”
- Head of Compliance: “Our data has to stay in the country. Where would you store it?”
Questions people ask
How do you respond when a CISO won't send logs to an observability vendor?
Agree that logs can contain personal data. Ask which data must never leave and what their data protection team needs, then show how that data can be filtered or masked before it's sent, where it's stored and who can access it.
Can you remove personal data from logs before sending them?
Often, yes. Many observability tools can filter or mask sensitive fields before data leaves the customer's environment. It's worth checking exactly how, and agreeing the rules with the data protection team.
More objections in Observability
- “Our monitoring bill keeps going up”
- “Outages haven't hurt us”
- “Teams won't instrument their code”
- “We already have three monitoring tools”
Practise it before the real call
Free to start. No credit card.