Data handling
Document data classes, lawful access, flows, retention, deletion, subprocessors and geographic constraints.
Secure by design
Security
Security requirements are defined before production scope and verified throughout delivery.
Identity and access
Use least privilege, separate environments, unique identities, MFA and auditable role-based access.
Application controls
Threat model integrations, retrieval, tools, prompts, outputs, dependencies and human override paths.
Operations
Maintain logging, monitoring, incident response, vulnerability management, backups and controlled change.