Security and Privacy

A security review of the Pedal Point assistant finds three things in an afternoon: the full customer record, phone number and address included, goes to the model with every question; every prompt is logged in plain text forever; and the payment provider's API key sits in the system prompt "so the model can check payments". None of this was malicious. It was just convenient.

The rule

Send only what the task needs; never send what must not leak.

Every piece of data you put in a prompt can travel: to the model provider, into your logs, and, with a clever enough request, back out in an answer. So design as if it might.

Keep secrets out. API keys, passwords and internal URLs never belong in a prompt. Tools that need credentials hold them in your server code, where the model cannot see them.

Minimise personal data. "Where is my order?" needs one order's status and date, not the customer's address, phone and payment details. Less data sent means less that can leak.

Scope every lookup to the user. When the assistant retrieves orders or documents, your code filters by the logged-in customer's ID. Never rely on the model to decide whose data it may see.

Mask where you can. Replace names, emails and card numbers with placeholders before logging or before sending when they are not needed.

Handle logs as sensitive data. Prompts and replies are full of personal details. Limit who can read them, and delete them after a set period.

Know your provider's terms. Check how a hosted model provider stores the data you send and whether it may be used for training, and choose settings that match what you promise your customers.

Tag requests with a user ID. Attaching an anonymous, stable ID for each end user (a hash, not their email) to requests and logs helps you trace abuse to one account. Some providers let you pass such an ID with each call.

The shortcut

Three words for every field in a prompt: minimise, mask, scope. Is it needed? Can it be masked? Is it limited to this user?

The trap is "the model will keep it private". A model has no concept of confidentiality; anything in its context can come out.

Drills

Answer fast — trust the rule.

Remember

• Send only what the task needs; never send what must not leak.
• Minimise, mask, scope — for every field.
• Logs are sensitive data too; the model keeps no secrets.