Can I put real customer data in a sandbox project?
Don't. Sandbox projects trade safeguards for testability — hard-delete and direct contact-method overrides are enabled — so they're not appropriate for real customer PII, production traffic, real billing, or compliance data. Keep real users on a live project and use sandbox for tests, QA, and demos.