Third-Party Model Security

Security Requirements

When using third-party models hosted in the cloud, the following security requirements apply:

1. Authorization

Third-party models used in the solution MUST be authorized by the organization's information security team. Do not integrate with arbitrary third-party model providers without security review and approval.

2. Encrypted Communication

Connections to third-party model endpoints MUST be encrypted. All API calls to external model services must use TLS (HTTPS). Never send prompts or receive responses over unencrypted channels.

3. Credential Management

Credentials for third-party model endpoints MUST NOT be stored in source code. They must be managed and stored securely.