Security controls
Server-side only
Keep API calls in trusted backend services. Never embed the key in browser or mobile code.
Least-privilege scope
Create separate keys for separate systems and authorize only required tenants and divisions.
Secret manager
Store, rotate, and audit credentials through a managed secret store.
Request correlation
Log request IDs instead of complete payloads wherever possible.
Data-minimization rules
- Request only the fields and resources required by the integration.
- Do not copy complete API responses into general application logs.
- Do not attach unrelated or excessive personal data to incidents.
- Avoid sending production personal data in support tickets.
- Protect downloaded payroll and contract files with local access controls.
- Define retention and deletion rules for checkpoints, logs, files, and dead-letter queues.
- Encrypt data in transit and use encrypted storage appropriate to the customer’s environment.