> Palantir [...] gets access to sensitive FCA data.

Is this the right characterization? Is Palantir being given access to the data(to do with what they like), or is Palantir software being deployed in the customer private cloud environment?

I am under the impression that Palantir is typically deployed on-premise, or in a private cloud, where the customer can ensure that the data remains sovereign.

Particularly in a military setting, it would be deployed in an airgapped or highly controlled network.