Calling a machine private does not make the files private. The word is a list. Either the list is true, or the word is decoration.
Before I copy a personal file onto the machine in my office, this is the list.
The disk is encrypted, and a reboot asks for the passphrase. If the first boot image does not offer that, I rebuild the disk with encryption while it is still empty, because that is the only time the step is cheap. That is the cheap time. A disk that already holds the files is how this step gets postponed forever.
The machine is not open to the public internet. Sign-in is a key. A password shared with anyone else is not the login. The router does not forward a port to the box.
Backups are encrypted, they land on a machine I control, and I have restored one file from a backup on purpose. A job that says it ran, and has never been restored, is a rumor.
The model that reads the raw file runs in the room. A cloud model does not get the file. If I use one, it receives a redacted result, and I can show what was taken out.
Software I install later does not get to rewrite what a tool claims to do. I write down what the model may read and what it may send. I check the list again after a real run.
For any question I care about, I can say what ran and what it read. If I cannot say that, the system is not ready for a record.
Who else should ask for the list
A firm about to let a model near its books should ask for the same list, in writing, before the pilot starts. Hardware sitting in the office still fails if the disk is open, if a backup has never been restored, or if the raw file leaves anyway.