Genie allows you to use serverless as well as classic compute (sql warehouse). Classic compute runs within your tenant using your vpc/vnet. Irrespective of the type of compute you use, data needs to be read into it and this applies to any other solution as well. In case of databricks sql warehouse (serverless) you have an option to use a) NCC > Private Link to your storage accounts ie secure ingress control to read data b) Network polcies ie to prevent data exfiltration or have an egress f/w. Further more you are allowed to bring your own encryption keys aka CMK to encrypt the metadata / queries saved within the genie space. In short there are several options available to utilize genie and not compromise your security posture and that’s the true value of our platform “optionality”.