Credentials, data, and incident handling
Build practical controls around least privilege and data minimization.
Protect the credential lifecycle
Assign an owner and purpose to each credential and avoid sharing it across environments. Use controlled secret storage and appropriate host permissions. Keep keys out of frontend bundles, repositories, and screenshots. Prepare rotation and revocation procedures in advance, while confirming which service-side controls are actually available rather than assuming they exist.
Minimize transmitted and retained data
Before sending data, establish authorization, business necessity, and applicable policy. Redact irrelevant personal information where possible. Do not assume a particular retention period, training exclusion, or data location commitment for prompts or responses. Obtain written confirmation of any required conditions before deciding whether the integration fits the intended use case.
Prepare incident response evidence
If exposure is suspected, contain affected credentials and workloads, preserve necessary records, and notify the responsible owner. Give support redacted request identifiers and a relevant time window, not secrets or complete customer content. This is security design guidance, not a certification, a compliance assurance, or a promised incident response time.