The lost-laptop report has no data section

An engineer leaves a laptop in a taxi in Chicago. On a fleet where the laptop is the workstation, that's a breach investigation: was the disk encrypted, what was synced, who gets the disclosure letter.

On this fleet the laptop was a browser. The code lived in a container and was edited through the editor URL. The database lived on the server and was queried through a URL. The display session rendered pixels; the files stayed on the box. IT deletes the engineer's auth tokens: one call: and reissues them on the replacement machine that afternoon.

The incident report lists a hardware loss, a token rotation, half a day of lost productivity. The data-exposure section says "no company data stored on the device," and security can write that because the workstation never lived there, not because a policy said it shouldn't.

The laptop was a window, and you can't steal the room through the window.