---
title: "Security"
manual: "AI Assistant"
version: "main"
source: "Administration/Security.rst"
rendered: "2026-10-03T14:54:45+00:00"
---

# Security {#security}

AI Assistant processes user questions and project content. Review security and
privacy requirements before enabling it in production.

## Recommendations {#recommendations}

-   Store provider credentials only in connection records.
-   Mask sensitive data in pipeline logs where possible.
-   Limit logged payload size.
-   Avoid indexing personal data unless there is a clear legal and operational
    basis.
-   Treat retrieved content as data exposed to the assistant.
-   Review frontend source fields before exposing metadata to users.
-   Restrict backend access to trusted administrators.

## Prompt safety {#prompt-safety}

Assistant and step prompts should clearly state that answers must be grounded in
retrieved context and that missing information must not be invented.