​

Security controls are layered across identity, data, and operations.

​

Identity and access controls

• Separate auth mechanisms for JWT, tenant API keys, partner API keys, and runtime server keys.
• Scope-based API key authorization with explicit route-family permissions.
• Tenant-aware authorization boundaries with optional tenant-context header where supported.
• Least-privilege key issuance and periodic scope reviews recommended for all customers.

​

Data protection controls

• TLS in transit for API and webhook communication.
• Access-controlled storage and retrieval for call artifacts.
• Environment isolation model for sandbox versus production data handling.
• Configurable data lifecycle controls via retention and export workflows.

​

Operational security controls

• Request IDs and structured logs for incident triage.
• Retry-safe webhook patterns and dedupe guidance to reduce side-effect risks.
• Controlled rollout guidance for production campaign activation.
• Key rotation and revocation support through API key management endpoints.

​

Incident handling and support flow