> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iqrush.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Protect credentials and customer data

> Build the integration so that access stays with the authorized user and reports expose only the information their audience needs.

Build the integration so that access stays with the authorized user and reports expose only the information their audience needs.

## Credentials

Keep access and refresh tokens in a server-side secret store or the host's credential mechanism. Use HTTPS. Do not include tokens in query strings, screenshots, source control, frontend bundles, support tickets, or generated reports. For OAuth, validate state and use PKCE as described in [authentication](/developers/guides/04-authentication).

Treat Dev and production as separate environments. Use separate configuration and credentials. A successful Dev read does not establish production access or deployment readiness.

## Data in reports

Project names, prompts, answers, URLs, and commercial results can be sensitive even when the cited pages are public. Keep exports restricted to their intended audience. Request full answer text only when the report needs it, and retain only necessary evidence.

When producing a public report, select the fields to display instead of embedding a complete raw payload. Technical diagnostics, opaque method identifiers, assistant instructions, and internal field explanations do not belong in customer-facing report copy. Preserve numerical uncertainty and meaningful availability information without publishing implementation detail.

## Assistant use

An assistant's written assessment depends on the tools it called, the scope it selected, and how it interpreted the results. Ask it to identify the project, runs, filters, and evidence for material claims. A reliable measurement does not guarantee an error-free narrative.

Use the host's access controls for the conversation or generated file. Connecting IQRush does not make an external assistant's storage and sharing settings identical to IQRush's settings.

## Removing access

Disconnect the client in IQRush when it should no longer access the account. If a credential may have been exposed, revoke the connection and authorize a replacement. Check whether any copies of reports also need their sharing permissions changed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.