Map the complete data path
List the application, gateway, selected seller or provider, and any upstream service that processes the request. Include uploaded files, image or audio inputs, generated outputs, and tool results alongside text prompts. Identify which data is confidential or personal and remove fields the task does not need. For Rock API, start with the security and privacy guide, then verify the terms of the exact model or marketplace service you plan to use. Ask for written clarification when a document does not answer a requirement. A general statement about one route does not automatically cover every seller or upstream model.Ask for evidence, not a broad assurance
Do not infer regulatory compliance, a data residency guarantee, or a contractual zero-retention arrangement from HTTPS or an OpenAI-compatible interface. Confirm any required data processing agreement and applicable exceptions with the service operator.
Protect credentials and your own logs
Keep API keys on the server, use a secret manager, and separate development, staging, and production. Limit access to people and services that need it; use scopes and spending controls where available. Document key ownership, revocation, and rotation, and practice replacing a compromised key. Review logs across your application, SDK, reverse proxy, observability tools, and support exports. Debug logging can capture full payloads even when your normal application log does not. Redact authorization headers and avoid storing customer content by default. Use synthetic data to check error paths before introducing production records. Usage metadata also needs review. Request IDs, timestamps, model names, token counts, IP addresses, and account identifiers can expose business activity or identify a person when combined. Define a purpose, retention period, and access policy instead of assuming all non-prompt data is anonymous.Make a documented release decision
Record the reviewed service, documents, review date, approved data categories, unresolved questions, and responsible owner. Test redaction and access controls, verify an incident contact, and decide which workloads must remain blocked until requirements are met. Reassess after changing a model, seller, routing configuration, or logging feature.Manage API keys securely
Plan credential storage, rotation, and revocation alongside your service and data handling review.