Committed seeds and fixtures contain no real-looking PII

SOC 2 C1.1 requires identifying and protecting confidential information, and a git repository is the leakiest place personal data can live: it is cloned to every laptop, mirrored to CI runners, shared with contractors, and immortal in history even after deletion. Real customer rows exported into a seed file "just to have realistic test data" are a confidentiality breach an auditor will flag on day one, and the pattern is common in AI-built projects because coding assistants happily paste a production query result into prisma/seed.ts when asked for sample data. Unlike a leaked key, leaked PII cannot be rotated: once an email address, SSN, or card number is in history, the exposure is permanent. This check evidences SOC 2 C1.1 by verifying that committed data files use synthetic, reserved-domain, or documented-test values only.

Replace real values in seeds and fixtures with synthetic data: use @faker-js/faker configured to emit reserved documentation domains (faker.internet.email({ provider: 'example.com' })), the 555-01XX fictional phone range, and processor-published test card numbers (Stripe's 4242424242424242). Purge already-committed real values from git history with git filter-repo (history persistence is the actual exposure, not just the current tree), then add a secret/PII scanning step to CI so regressions are caught at commit time.