# Security & data handling

Use this guide when designing your integration or preparing a security review. Start with the data your workflow touches, then review connection credentials, diagnostics, permissions, and any systems receiving the results.

## Zero Data Retention and its boundaries

Apideck's cloud Unified APIs process business records in memory through a real-time pass-through layer, rather than retaining a synchronized copy. Zero Data Retention (ZDR) is part of that architecture, not a setting you enable.

| Data or connection | Handling boundary |
| --- | --- |
| Business records through cloud connectors | Passed through without retaining a copy of the underlying records. |
| Vault credentials | OAuth tokens are stored encrypted to maintain connections. |
| Optional API Logs | Logs can contain full request and response bodies, including business records. Review your application’s log retention separately from ZDR; set retention to 0 to disable storage. |
| QuickBooks Desktop | The on-premises sync can require temporary data storage. This is an exception to cloud pass-through. |
| Your application, queues, and AI tools | Their storage and retention policies apply after they receive data. |

See the [Zero Data Retention architecture](https://www.apideck.com/zero-data-retention) for the published scope and exceptions. Review the [on-premises connector guide](/guides/on-premises-connectors) before enabling QuickBooks Desktop.

## Keep connection credentials separate from business data

Use [Vault](/guides/vault) to manage customer connections. Create sessions from your backend and associate each session with the correct consumer. Keep your Apideck API key out of browser bundles, mobile applications, source control, and screenshots.

For a multi-tenant application, resolve the consumer from your authenticated user's organization on the server. Do not let an arbitrary consumer ID supplied by a browser select another customer's connection. Test this boundary with two separate test organizations before rollout.

[Vault Links](/guides/vault#vault-links) provide another onboarding path. When an administrator or agent starts onboarding, confirm which customer and connection the link is intended for before sharing it.

## Limit permissions to the workflow

List the operations your product needs before requesting provider permissions. An invoice reporting feature and a bill creation feature need different access. Review the connector's configuration guide and verify the connected user's permissions in the source system.

Use [Accounting Data Scopes](/guides/data-scopes-for-accounting) or [HRIS Data Scopes](/guides/data-scopes-for-hris) for field-level access controls. Test both allowed and denied access; a successful read does not establish permission to write.

Explain the purpose of access to customers during onboarding. The [end-user consent guide](/guides/end-user-consent) covers how to present that information alongside the connection flow.

## Review logs and debugging exports

Before enabling diagnostics, review your application's logging configuration and who can inspect or export logs. Follow the [API Logs guide](/logs) to understand parent requests and downstream child requests.

When investigating an error, start with the request ID, timestamp, consumer, connector, operation, and status. Share only the payload fields needed to reproduce the issue. Remove credentials and unrelated customer data from support tickets, screenshots, copied responses, and test fixtures.

Apply the same review to your own error tracker, webhook inbox, retry queue, and database backups. Record an owner and a retention policy for each place your integration writes data.

## Agent and MCP workflows

Map the complete path from connector to tool response to model or agent. Review the MCP client's conversation history, tracing, and model-provider retention settings independently. Avoid sending a complete customer record when selected fields are enough for the task.

Keep authorization checks in your application when an agent selects a consumer or proposes a write. Require the same business approvals you would for a human-initiated payment or accounting change. See [building with LLMs](/building-with-llms) for the developer tooling.

## Security and compliance documents

Use the [Trust Center](https://compliance.apideck.com/) as the source for current security information and certification materials. For a review, start with:

- [Security practices](https://compliance.apideck.com/security)
- [Data Processing Agreement](https://compliance.apideck.com/dpa)
- [Subprocessors](https://compliance.apideck.com/subprocessors)
- [Privacy Policy](https://compliance.apideck.com/privacy-policy)

Record the documents and versions your team reviewed alongside your connector choices and logging configuration. Use the Trust Center's contact options for questions about contractual requirements or evidence; this implementation guide does not replace those documents.