Correction to unicode character

content/post/the-data-surrender-trap/index.md

@@ -19,7 +19,7 @@ Generative AI has lit a fire under every product road-map. Faced with “ship it
 
 Handing raw customer data to a third party introduces two long-term headaches:
 
-1. Governance and compliance risk – once data leaves your perimeter, you lose direct control over how long it’s stored, where it resides, and who can see it. A single mis-configuration or model-training clause could violate GDPR, HIPAA, or internal policy.
+1. Governance and compliance risk – once data leaves your perimeter, you lose direct control over how long it's stored, where it resides, and who can see it. A single mis-configuration or model-training clause could violate GDPR, HIPAA, or internal policy.
 2. Technical debt – the day you need to swap providers, migrate regions, or delete a customer record, you discover tight coupling in schemas, pipelines, and security controls that were never designed for portability.
 3. Technical debt - having to synchronize data between multiple vendors and your own systems, which can lead to data inconsistencies and increased complexity.
 
@@ -45,10 +45,10 @@ Before we look at any vendor implementation, it helps to know the building-block
 
 | Layer | Open standard | Why it matters |
 | --- | --- | --- |
-| Table formats | Apache Iceberg, Delta Lake, Apache Hudi, Parquet | Column-oriented, ACID-capable tables that sit in ordinary cloud storage and are readable by engines like Spark, Trino, Flink, etc. Iceberg’s spec is fully open, so any vendor can implement it—preventing lock-in and enabling multi-cloud lakes. |
+| Table formats | Apache Iceberg, Delta Lake, Apache Hudi, Parquet | Column-oriented, ACID-capable tables that sit in ordinary cloud storage and are readable by engines like Spark, Trino, Flink, etc. Iceberg's spec is fully open, so any vendor can implement it—preventing lock-in and enabling multi-cloud lakes. |
 | Governance / access control | Apache Ranger, Open Policy Agent, Unity Catalog, Lakekeeper | Centralize table/row/column policies, data masking, and audit logs across dozens of engines and clouds—without embedding rules in every service. Ranger policies even support dynamic row-level filters. |
 | Data lineage | OpenLineage | A vendor-neutral API for emitting and collecting lineage events from Spark, Airflow, dbt, BigQuery, and more. Lets you trace every model back to the exact inputs that produced it. |
-| Zero-copy data sharing | Delta Sharing (REST), Iceberg REST Catalog, Arrow Flight SQL | Instead of emailing CSVs, expose live tables through open protocols. Recipients query directly—Spark, Pandas, BI tools—while you keep full revocation and audit control. Delta Sharing is the first open REST protocol for this purpose; Iceberg’s REST catalog spec and Arrow Flight do the same for metadata and high-speed transport. |
+| Zero-copy data sharing | Delta Sharing (REST), Iceberg REST Catalog, Arrow Flight SQL | Instead of emailing CSVs, expose live tables through open protocols. Recipients query directly—Spark, Pandas, BI tools—while you keep full revocation and audit control. Delta Sharing is the first open REST protocol for this purpose; Iceberg's REST catalog spec and Arrow Flight do the same for metadata and high-speed transport. |
 
 What this unlocks:
 
@@ -60,7 +60,7 @@ With these open standards in place, any platform that respects them can satisfy
 
 ## Databricks: the platform that delivers all four guard-rails
 
-Databricks’ Lakehouse architecture assembles the pieces in one stack:
+Databricks' Lakehouse architecture assembles the pieces in one stack:
 
 - **Delta Lake** – Open-source ACID tables on cloud object storage. You keep data in your S3/ADLS/GCS buckets; Databricks adds versioning, upserts, and time-travel without changing file formats.
 - **Unity Catalog** – A multicloud metastore that applies table/row/column permissions, tags, and audit logs across SQL, Python, BI dashboards, and ML pipelines. Governance once, enforced everywhere.
@@ -86,7 +86,7 @@ Key take-aways:
 - Every provider now markets a “lakehouse” story; the difference is openness and ecosystem lock-in.
 - AWS, Google, and Azure each solve the problem well inside their cloud. Multi-cloud or future migration can be harder.
 - Snowflake excels at instant sharing inside its service but requires you to load data into Snowflake storage (or at least pay Snowflake to query external tables).
-- Databricks’ bet is that open formats + open sharing + multi-cloud governance reduce long-term friction.
+- Databricks' bet is that open formats + open sharing + multi-cloud governance reduce long-term friction.
 - Google Cloud's BigLake provides external connection to Delta Lake and Iceberg
 
 
@@ -108,12 +108,12 @@ Each step below tightens control, reduces copies, and shows how to give an exter
 
 | Step | Action | Why / Tips |
 | --- | --- | --- |
-| Inventory & classify | <ul><li>Tag PII, payment data, trade secrets, regulated logs.</li><li>Record legal basis (GDPR, HIPAA, SOC-2 scope, etc.).</li></ul> | You can’t apply least-privilege sharing if you don’t know what’s sensitive. |
+| Inventory & classify | <ul><li>Tag PII, payment data, trade secrets, regulated logs.</li><li>Record legal basis (GDPR, HIPAA, SOC-2 scope, etc.).</li></ul> | You can't apply least-privilege sharing if you don't know what's sensitive. |
 | Land everything in open, governed tables | <ul><li>Convert CSV/Parquet to Delta / Iceberg with schema enforcement & time-travel.</li><li>Store in your S3 buckets / Google Cloud Storage; enable server-side encryption and object-lock.</li></ul> | Open formats + immutable history make later audits and deletions possible. |
 | Switch on a unified catalog | <ul><li>Unity Catalog / Lake Formation / Purview / Dataplex / Lakekeeper.</li><li>Import IAM groups, apply column masks, row filters, dynamic data tags (“pii = true”).</li></ul> | One policy engine ≫ dozens of per-tool ACLs. |
 | Harden the perimeter | <ul><li>Private subnets, VPC peering, and storage firewall rules so only approved compute can touch raw data.</li><li>Disable public buckets & open egress unless justified.</li></ul> | Keeps “shadow ETL” from copying data out the side door. |
-| Safely share with an external AI vendor (zero-copy) | <ol><li>Minimise first – aggregate, pseudonymise, or drop columns the vendor doesn’t need.</li><li>Create a Share (Delta Sharing / Iceberg REST / Arrow Flight):  <ul><li>Grant only the filtered table or view.</li><li>Attach row-level filters & column masks.</li><li>Issue a time-boxed bearer token (7-, 30-, or 90-day TTL) and pin it to the vendor’s IP range. Databricks DocumentationDatabricks</li></ul><li>Contract & controls – DPA, usage policy, no onward sharing.</li><li>Monitor – streaming audit of every query; set alerts for unusually large scans.</li><li>Revoke or rotate the token the moment the engagement ends (one CLI/API call).</li></ol> | Zero-copy protocols let the vendor query live tables without replicating them. Instant revocation closes the door the second you’re done. |
-| Move internal ML pipelines onto the platform | <ul><li>Use Spark + MosaicML (or SageMaker/Vertex/Azure ML) inside the governed workspace.</li><li>Log models to a central registry; tag each with source-data lineage.</li></ul> | No more exporting giant CSVs to Jupyter on someone’s laptop. |
+| Safely share with an external AI vendor (zero-copy) | <ol><li>Minimise first – aggregate, pseudonymise, or drop columns the vendor doesn't need.</li><li>Create a Share (Delta Sharing / Iceberg REST / Arrow Flight):  <ul><li>Grant only the filtered table or view.</li><li>Attach row-level filters & column masks.</li><li>Issue a time-boxed bearer token (7-, 30-, or 90-day TTL) and pin it to the vendor's IP range. Databricks DocumentationDatabricks</li></ul><li>Contract & controls – DPA, usage policy, no onward sharing.</li><li>Monitor – streaming audit of every query; set alerts for unusually large scans.</li><li>Revoke or rotate the token the moment the engagement ends (one CLI/API call).</li></ol> | Zero-copy protocols let the vendor query live tables without replicating them. Instant revocation closes the door the second you're done. |
+| Move internal ML pipelines onto the platform | <ul><li>Use Spark + MosaicML (or SageMaker/Vertex/Azure ML) inside the governed workspace.</li><li>Log models to a central registry; tag each with source-data lineage.</li></ul> | No more exporting giant CSVs to Jupyter on someone's laptop. |
 | Expose governed model endpoints | <ul><li>Deploy behind Model Serving (or cloud equivalent).</li><li>Protect with catalog-level ACLs, network policies, and request logging.</li></ul> | External apps can call for predictions without direct data access. |
 | Automate audits & drift detection | <ul><li>Scheduled jobs that flag:  – Tables without tags / owners  – Shares approaching token expiry  – Models trained on untagged data</li><li>Pipe findings to Slack / JIRA for triage.</li></ul> | Governance-as-code keeps guard-rails from eroding over time. |
 
@@ -131,4 +131,4 @@ The AI race rewards the companies that can move fast without surrendering their
 
 Do those three things and you flip the script: instead of pushing raw tables out to a black-box vendor, you invite algorithms, fine-tuning jobs, and BI tools into a tightly controlled environment. The result is faster experimentation (no week-long data exports), fewer compliance nightmares (every read is logged and revocable), and zero re-platform tax when the next cloud, model, or regulation arrives.
 
-In short, **bringing AI to your data—under open, governed standards—isn’t just best practice; it’s the only sustainable data strategy for the decade ahead.** Adopt it now, and each new AI breakthrough becomes an easy plugin rather than a risky migration. Your teams keep innovating, your security team keeps sleeping, and your customers keep trusting you with their data.
+In short, **bringing AI to your data—under open, governed standards—isn't just best practice; it's the only sustainable data strategy for the decade ahead.** Adopt it now, and each new AI breakthrough becomes an easy plugin rather than a risky migration. Your teams keep innovating, your security team keeps sleeping, and your customers keep trusting you with their data.