Platform Security Standards
Transport Security
- HTTPS/TLS 1.2 minimum (TLS 1.3 preferred) for all API communications
- Full certificate chain validation
- Modern, secure cipher suites only
- HSTS headers recommended
Encryption Requirements
- Data in transit: TLS 1.2+
- Data at rest: AES-256 for stored data
- Encryption key management: Industry-standard practices
Network Security
- IP whitelisting available (static IPs provided upon integration setup)
- Document firewall requirements
- Azure DDoS Protection or equivalent recommended
API Security Best Practices
- Rate limiting (see API & Integration Methods)
- Server-side input validation
- Parameterized queries to prevent SQL injection
- Output encoding to prevent XSS
- Appropriate CORS policies for web integrations