> ## Documentation Index
> Fetch the complete documentation index at: https://help.avoca.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform Security Standards

> Baseline security requirements for Avoca custom-integration connectivity.

# Platform Security Standards

## Transport Security

* Use HTTPS with TLS 1.2 or later for API and webhook traffic
* Validate the complete certificate chain and hostname
* Keep certificates current and use modern cipher suites
* Do not disable certificate verification in production clients

## Authentication and Secrets

* Use the authentication method agreed for the integration
* Store credentials in an approved secrets manager
* Scope credentials to the minimum required access
* Rotate or revoke credentials after suspected exposure, personnel changes, or integration retirement
* Never place production credentials in source control, examples, logs, or support tickets

## API Security

* Validate input and enforce authorization on the server
* Use parameterized data access and safe output encoding
* Apply appropriate request-size, rate, and abuse controls
* Return structured errors without sensitive implementation details
* Use idempotency controls for retryable write operations

## Network and Availability Controls

Network restrictions, static egress addresses, private connectivity, DDoS controls, and provider-specific firewall requirements depend on the integration architecture. Document them during technical design rather than assuming they are available for every Avoca endpoint.

See [API and Integration Methods](./api-methods) for contract-design guidance.