[ratorx]

Anonymisation has always seemed to me to be a reduction in the probability of exposure rather than a complete guarantee of safety.

Arguably you should need compliance on both staging and prod, but you do the anonymisation to reduce the risk of exposure from (less tested) code in staging.

I’ve always viewed staging as the environment that gets prod data (maybe anonymised), but has ideally no exposure to actually affecting prod, rather than a completely fake environment.