Security and privacy

Your Portal account

You can read public documentation without signing in. Developer accounts use email-code sign-in and, when offered, Google, GitHub or Microsoft. Signing in establishes your identity; an approved invitation, accepted agreement and active entitlement are separately required for protected package downloads. Each download checks access again. Package Access explains the current preview path.

Authenticated Guide can answer questions and help eligible preview participants draft integration code. It does not run proposed code or act on your business systems. Guest Guide uses selected public documentation; authenticated Guide and code assistance have separate access and usage controls.

How Portal information is handled

The Portal processes account and security information to operate sign-in and access. Authenticated Guide stores account-bound conversations, feedback and usage records. When you use Integrate Core with My App, your submitted code, description and follow-up context go to the configured AI provider for the answer. That code and generated proposals are not saved in Guide conversation history, but infrastructure and provider systems may retain content under their own settings. Keep sensitive information out of submissions. See the Privacy Policy for the current processing, cookies, retention qualifications and privacy requests.

Use Account security to review sign-in methods. Connect another provider only after signing in to your existing account; matching email addresses alone do not merge accounts.

Secure your integration

Your application authenticates callers, establishes tenant and account scope, applies its business authorization, protects provider credentials and controls who can inspect retained evidence. Treat model output, callbacks and provider responses as untrusted until your host checks their source, ownership and scope. Use an independent verifier to read the authoritative business record before claiming an effect occurred. A provider acknowledgment or diagnostic log is not that proof.

Keep raw credentials, customer records, unrestricted provider payloads and live result objects out of public output, logs and Trace files. Set storage access, retention, deletion, monitoring and incident handling for your own deployment. Start with Trusted context, Provider and verifier responsibilities and Diagnostics & Logging. Do not enter secrets into public examples or support messages.