> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paywalls.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Compliance

This page summarizes how Paywalls handles authentication, data, and payments, and what you should do to keep your integration secure.

## Authentication & key management

* Keep your paywall API key server‑side only (server, edge function, or backend‑for‑frontend).
* Use environment variables or a secret manager; never hard‑code secrets in code or frontends.
* Rotate keys if you suspect exposure; remove old keys and redeploy.
* Prefer restricted provider keys (e.g., Stripe Restricted Key) with the least scopes needed.
* Use `Idempotency-Key` for non‑idempotent POSTs (e.g., manual charges, deposits) to prevent duplicates.

See also:

* [Idempotency](/more/errors-limits-reliability)
* [Connect Stripe](/how-to-guides/connect-stripe)

## Data handling & privacy

* Pseudonymous users: prefer stable, pseudonymous `user` IDs; avoid sending PII where not required.
* Data minimization: do not include secrets or PII in prompts, system instructions, or `metadata` fields.
* Operational metadata: ledgers and logs store request identifiers (e.g., `user`, `requestId`, model id) for billing, support, and audit.
* Prompts & outputs: your app controls what content is sent to providers; treat prompt data as potentially sensitive.
* Encryption in transit: all APIs require HTTPS (TLS 1.2+).

See [Privacy](/privacy) for full privacy policy and data subject rights.

## Payments & PCI scope

* Default mode: you collect funds into app‑scoped balances via your own rails (e.g., Stripe). Card data remains within Stripe flows; Paywalls does not handle raw card numbers.
* Shared mode: Paywalls hosts top‑ups; checkout and card handling occur with our payment providers. Your earnings accrue on usage and are available for withdrawal per policy.
* Taxes/invoicing: your app remains responsible for its own ToS, privacy, and tax obligations to end users.

See:

* [Connect Stripe](/how-to-guides/connect-stripe)
* [Test keys & environments](/more/test-keys-and-environments)

## Network & transport security

* All API endpoints are served over HTTPS; reject plain HTTP.

## Data retention & deletion

* We never store prompt or output contents; only request metadata (e.g., usage data, model/version, timestamps, pseudonymous `user`/request identifiers) is retained.
* Ledger entries are retained for billing and audit purposes.
* Operational logs are retained for troubleshooting and reliability.
* Configurable retention and regional data hosting are on the roadmap. Contact us for current defaults and options.
* For data deletion requests, contact support with relevant identifiers (`user`, ledger ids, request ids) to assist.

## Compliance posture

* We design systems and processes to support common regulatory requirements (e.g., GDPR/CCPA principles of data minimization, access, and deletion on request).
* Data Processing Addendum (DPA) and subprocessors list are available on request.
* Formal certifications (e.g., SOC 2) are on the roadmap; reach out for current status.

## Vulnerability & incident response

* Responsible disclosure: report potential vulnerabilities to [legal@paywalls.ai](mailto:legal@paywalls.ai). Provide details and reproduction steps.
* We assess, prioritize, and remediate security issues based on severity.
* In the event of a security incident affecting your data, we will notify impacted customers consistent with legal and contractual obligations.

## Backups & disaster recovery

* Regular backups of critical data with encrypted storage.
* Service restoration and continuity procedures are maintained;

## Your responsibilities

* Keep secrets server‑side; never expose paywall, stripe or provider keys to browsers or untrusted clients.
* Send a `user` with every billable request; avoid PII where possible.
* Verify webhooks, log request identifiers, and make side‑effects idempotent.
* Follow your local laws and platform policies (privacy, taxes, consumer protection).

Questions or requests (e.g., DPA, retention details, incident reports): [legal@paywalls.ai](mailto:legal@paywalls.ai)