Security and compliance

• Use TLS for all traffic.
• Keep secrets server-side only.
• Apply least privilege for dashboard/API access.
• Avoid sensitive PII in logs.
• Follow GDPR/LPD data minimization and retention rules.